Language Selection

English French German Italian Portuguese Spanish

About Tux Machines

Tuesday, 16 Jan 18 - Tux Machines is a community-driven public service/news site which has been around for over a decade and primarily focuses on GNU/LinuxSubscribe now Syndicate content

Search This Site

Quick Roundup

Type Title Author Replies Last Postsort icon
Story deepin 15.5 - A different desktop Roy Schestowitz 15/01/2018 - 5:17am
Story Linspire, Freespire and Black Lab Enterprise Linux Patched Roy Schestowitz 15/01/2018 - 5:08am
Story Linux 4.15 RC8 and Linux Kernel Mailing List Downtime Roy Schestowitz 1 15/01/2018 - 4:59am
Story GPD Win 2 – A Pocket-Sized Linux Games Machine? Roy Schestowitz 15/01/2018 - 4:40am
Story Today in Techrights Roy Schestowitz 14/01/2018 - 11:03pm
Story Games: CAPS0ff, Godot, Quake 4, Event[0], Cold Space, Tale of Toast Roy Schestowitz 14/01/2018 - 9:15pm
Story Graphics: Weston, Trends and Benchmarks Roy Schestowitz 14/01/2018 - 9:13pm
Story today's howtos Roy Schestowitz 14/01/2018 - 9:11pm
Story Benchmarking Ubuntu's Low-Latency Kernel & Liquorix Post-Meltdown Roy Schestowitz 14/01/2018 - 6:13pm
Story Linux 4.15-rc8 Bringing BPF Security Improvements For Fending Speculative Attacks Roy Schestowitz 14/01/2018 - 6:07pm

Meltdown Patches and Problems

Filed under
Security
Ubuntu
  • [Ubuntu] Meltdown and Spectre Status Update

    On Tuesday, January 9, 2018 we released Ubuntu kernel updates for mitigation of CVE-2017-5754 (aka Meltdown / Variant 3) for the x86-64 architecture.

  • Lubuntu 17.10.1 (Artful Aardvark) released!

    Lubuntu 17.10.1 has been released to fix a major problem affecting many Lenovo laptops that causes the computer to have BIOS problems after installing. You can find more details about this problem here.

    Please note that the Meltdown and Spectre vulnerabilities have not been fixed in this ISO, so we advise that if you install this ISO, update directly after.

    This release is no different in terms of features from the 17.10 release, and is comparable to an LTS point release in that all updates since the 17.10 release have been rolled into this ISO. You can find the initial announcement here.

  • Check Linux for Spectre or Meltdown vulnerability

    Devices running Linux are affected by Spectre and Meltdown vulnerabilities as much as their Windows counterparts.

    Development teams work on updated kernels for the various distributions, and users need to update browsers and other software to protect data against potential attacks.

    We talked about identifying whether your Windows PC or web browser is vulnerable already. A recently published script does the same for Linux systems. You may use it to check whether your Linux distribution is vulnerable.

  • Meltdown Patch Is Causing Problems for Some Ubuntu Linux Users

    Many Ubuntu Linux users who installed the latest kernel updates to fix the Meltdown CPU vulnerability found themselves stuck in a boot loop and had to revert back to a previous version.

    The problem affected mostly Ubuntu 16.04 (Xenial Xerus), which is a long-term support (LTS) release. Soon after the 4.4.0-108 kernel update was released to fix the Meltdown vulnerability, users flooded the Ubuntu Forums and bug tracker to report booting problems.

  • Meltdown Update Kernel doesnt boot
  • Major Linux distros have Meltdown patches, but that's only part of the fix

    The Intel Meltdown security problem is the pain that just keeps hurting. Still, there is some good news. Ubuntu and Debian Linux have patched their distributions. The bad news? It's becoming clearer than ever that fixing Meltdown causes significant performance problems. Worst still, many older servers and appliances are running insecure, unpatchable Linux distributions.

Linspire 8.0 and Freespire 4.0 Slated for Release in mid-December 2018

Filed under
OS
Linux

If you think the release of Linspire 7.0 and Freespire 3.0 were just a one-off, think again because we're now in possession of the release roadmap for both operating systems, and it looks like we should be able to get our hands on the next major releases at the end of the year. But, in the meanwhile, we'll be able to test a lot of the beta versions for both Freespire 4.0 and Linspire 8.0, as well as to enjoy new incremental versions of current releases.

"Today we are releasing the release schedule and roadmap for Linspire and Freespire. These dates are not set in stone and there may be some alterations due to holidays and development mishaps. While the Freespire beta's will be available publicly the Linspire beta's will be available to subscription holders and insiders," says Roberto J. Dohnert in today's announcement.

Read more

KDE Applications 17.12 Open Source Software Suite Gets First Point Release

KDE Applications 17.12 is the latest and most advanced version of the open source software suite used in KDE Plasma desktop environments or independently. It was released last month on December 14 with numerous improvements and new features, including HiDPI support for Okular and Dolphin enhancements.

Now, the KDE Applications 17.12.1 minor bugfix release is out and brings more than 20 improvements to various of the included applications like Ark, Akonadi, Dolphin, Filelight, Gwenview, KGet, K3b, Kate, Kdenlive, Kleopatra, KMix, KMahjongg, Kontact, Okteta, Okular, and Umbrello.

Read more

Also: KDE Ships KDE Applications 17.12.1

Tiny solderable quad Cortex-A17 module has 4GB RAM and HDMI 2.0

Filed under
Android
Linux

Sudo’s solderable, 65 x 40mm “SudoProc” module features a 1.8GHz, quad-core, Cortex-A17 SoC with 4GB LPDDR3, up to 512GB eMMC, a GbE controller, HDMI 2.0, and -25 to 85°C support.

Slovenia-based startup Sudo Sistemi reached out to us with news of an upcoming SudoProc computer-on-module touted for being solderable and compact (65 x 40 x 4.3mm). Sudo has yet to get back to our request for confirmation that the module’s 1.8GHz, quad-core, Cortex-A17 SoC is a Rockchip RK3288, although we can’t imagine what else it might be.

Read more

today's leftovers

Filed under
Misc
  • Look Munich, City of Barcelona Is Dumping Windows and Switches to Ubuntu Linux

    While the City of Munich is switching back to Windows after running Linux on their public PCs, a move that will cost them over €100 million euros, the City of Barcelona is making the smart choice of dumping Microsoft's products and switch to Linux and Open Source.

    First spotted by It's FOSS, this fantastic news was reported by Spanish newspaper El País, stating that the City of Barcelona is currently in talks of migrating all of their public computer systems to Open Source software products like LibreOffice and Open-Xchange, replacing Microsoft's expensive products.

  • Clipboard Anywhere – A Multi-Platform Lightweight Clipboard App

    Clipboard Anywhere is a free, lightweight, and cloud-enabled clipboard application with which you can copy to and paste from its clipboard universally synced across all connected devices.

    It is important to remember that Clipboard Anywhere is NOT a clipboard manager app but simply a clipboard app via which you can have texts and images that you copy on your desktop available on your mobile devices and vice versa.

  • Storaji – A Free, Modern Lightweight Inventory Management System

    Storaji is a free, Electron-powered, open-source and lightweight Inventory Management System. Its development is aimed at Middle-Low Companies who might not be able to afford the license for similar applications to manage their stock.

  • How to Install Snipe-IT Asset Management Software on Debian 9
  •  

  • Introducing a Full Self-hosted Audio/video and Chat Communication Platform: Nextcloud Talk

    We’re very proud to announce today Nextcloud Talk, the first enterprise-ready, self-hosted communication technology giving users the highest degree of control over their data and communication. Nextcloud Talk is a fully open source video meeting software, on-premise hosted and end-to-end encrypted. It features a text chat and is available for web and mobile. In related news, Nextcloud has become the vendor with the greatest momentum in the self-hosted Enterprise File Sync and Share market and increased its customer base by 7 times in 2017. And over 500 individuals contributed more than 6.6 million lines of code to Nextcloud last year!

  • Nextcloud Talk is an Open Source Alternative to Google Hangouts

    Nextcloud has launched a self-hosted open source alternative to Google Hangouts, Skype, and similar chat services.

    Called ‘Nextcloud Talk’, the feature brings audio, video and messaging features based on WebRTC to the personal cloud server software, which was forked from OwnCloud back in 2016.

  • Nextcloud Rolls Out Audio/Video/Chat Support

    The Nextcloud cloud hosting software forked from ownCloud now has audio/video/chat abilities.

  • Krita Digital Painting Program Hits The 4.0 Beta Milestone

    The KDE/Qt-aligned Krita digital painting program has released its first beta release of the major 4.0 update that also marks its string freeze. Now marks the period of bug fixing before shipping Krita 4.0 within a few months.

  • Fedora 28 Looking To Replace Glibc's libcrypt With libxcrypt

    As upstream Glibc is working on deprecating libcrypt for its eventual removal from the codebase, Fedora developers are looking at using libxcrypt for their hashing/encoding crypto library.

    Some Fedora / Red Hat developers have been working on libxcrypt as the distribution's potential replacement to libcrypt. Libxcrypt is inspired in part by Openwall Linux, supports most all password hashing algorithms, offers a faster development cycle, and makes adding new hashing algorithms easy.

  • Sleep Fast, Sleep Hard with the Pzizz Android App
  • Five Ways to Free Up Space on Your Android Device
  • New Python3, LibreOffice, Google RE2 Packages Released in Tumbleweed

    Several openSUSE Tumbleweed snapshots arrive before and after the new year and this post will focus on the most recent snapshots released this week.

    Much of the efforts of developers this week have focused on patching the Meltdown and Spectre vulnerabilities. openSUSE’s rolling distribution produced four openSUSE Tumbleweed snapshots so far this week.

    While the Long-Term Support 4.4 Linux Kernel has patched many of the vulnerabilities associated with Meltdown and Spectre, the 4.14.12 Linux Kernel released in snapshot 20180107  hasn’t, but Tumbleweed users will likely see the vulnerabilities patched soon.

  • openSUSE Conference Registration, Call For Papers Opens Today

    openSUSE is pleased to announce that registration and the call for papers for the openSUSE Conference 2018 (oSC18), which takes place in Prague, Czech Republic, are open.

    The dates for this year’s conference will be May 25 through May 27 at Faculty of Information Technologies of Czech Technical University in Prague. Submission for the call for papers will be open until April 20. There are 99 day from today to submit a proposal, but don’t wait until the late minute. Registration will be open from today until the day oSC18 begins; make sure to answer the survey question regarding the T-Shirt size.

Red Hat on Microservices and Security

Filed under
Red Hat
Security
  • The State of Microservices

    During the fall of 2017, we conducted a microservices survey with our Red Hat JBoss Middleware and Red Hat OpenShift customers. From this, we were able to discover how these customers are using microservices to their advantage, what they see as some of the major benefits, what challenges exist and how to overcome them and how microservices can give respondents a competitive advantage. While these statistics are based off of a specific group of Red Hat customers, these findings give a good sense of the overall attitude toward microservices adoption and implementation. Read on to learn more about these findings.

  • What OpenShift Online and Dedicated customers should know about Meltdown and Spectre

    This past week, the technology world became aware of three significant security threats that could be used to allow cybercriminals to steal valuable data from an affected computer system. Together, these three bugs are commonly known as “Spectre” and “Meltdown” – a technical discussion of these vulnerabilities can be found here, and a non-technical explanation of the key facts is here.

  • Security updates for Thursday
  • Intel Releases Linux CPU Microcodes for Processors Going Back Two Decades

OSS and Programming Leftovers

Filed under
Development
OSS
  • Telecommunications Infrastructure Project looks to apply open source technologies

    The Telecommunications Infrastructure Project is looking to apply open source technologies to next generation fixed and mobile networks.

    The Telecom Infra Project (TIP), conceived by Facebook to light a fire under the traditional telecommunications infrastructure market, continues to expand into new areas.

    Launched at the 2016 Mobile World Congress in Barcelona, the highly disruptive project takes an open ecosystem approach to foster network innovation and improve the cost efficiencies of both equipment suppliers and network operators.“We know from our experience with the Open Compute Project that the best way to accelerate the pace of innovation is for companies to collaborate and work in the open. We helped to found TIP with the same goal - bringing different parties together and strengthen and improve efficiencies in the telecom industry,” according to Aaron Bernstein, Director of Connectivity Ecosystem Programmmes at Facebook.

  • Introducing Ad Inspector: Our open-source ad inspection tool
  • AI and machine learning bias has dangerous implications

    Algorithms are everywhere in our world, and so is bias. From social media news feeds to streaming service recommendations to online shopping, computer algorithms—specifically, machine learning algorithms—have permeated our day-to-day world. As for bias, we need only examine the 2016 American election to understand how deeply—both implicitly and explicitly—it permeates our society as well.

    What’s often overlooked, however, is the intersection between these two: bias in computer algorithms themselves.

    Contrary to what many of us might think, technology is not objective. AI algorithms and their decision-making processes are directly shaped by those who build them—what code they write, what data they use to “train” the machine learning models, and how they stress-test the models after they’re finished. This means that the programmers’ values, biases, and human flaws are reflected in the software. If I fed an image-recognition algorithm the faces of only white researchers in my lab, for instance, it wouldn’t recognize non-white faces as human. Such a conclusion isn’t the result of a “stupid” or “unsophisticated” AI, but to a bias in training data: a lack of diverse faces. This has dangerous consequences.

  • Pineapple Fund Supports Conservancy

    Software Freedom Conservancy thanks the Pineapple Fund and its anonymous backer for its recent donation of over 18 Bitcoin (approximately $250,000). The Pineapple Fund is run by an early Bitcoin adopter to give about $86 million worth of Bitcoin to various charities. Shortly after the fund’s announcement earlier this month, volunteers and Conservancy staff members applied for its support. That application was granted this week.

  • Top Programming Languages That Largest Companies Are Hiring Developers For In 2018

    Learning a programming language involves some important decisions on the part of a professional. Gone are the days when one mastered a single popular programming language and it granted job security. Highlighting these limitations of reliance on a single programming language, Coding Dojo coding school has shared the results of an interesting study.

  • Rust in 2018

    I think 2017 was a great year for Rust. Near the beginning of the year, after custom derive and a bunch of things stabilized, I had a strong feeling that Rust was “complete”. Not really “finished”, there’s still tons of stuff to improve, but this was the first time stable Rust was the language I wanted it to be, and was something I could recommend for most kinds of work without reservations.

    I think this is a good signal to wind down the frightening pace of new features Rust has been getting. And that happened! We had the impl period, which took some time to focus on getting things done before proposing new things. And Rust is feeling more polished than ever.

Linux, Linux Foundation, and Graphics

Filed under
Graphics/Benchmarks
Linux
  • Freedreno's MSM DRM Driver Wires In DEVFREQ Re-Clocking Support

    Freedreno open-source Qualcomm Adreno driver creator Rob Clark has sent in the set of updates for the MSM DRM driver targeting the Linux 4.16 kernel.

    The MSM Direct Rendering Manager updates for DRM-Next to go into Linux 4.16 are a bit late for the DRM staging, but these changes are mostly small. Besides some bug fixes and other minor code changes, the main feature addition for MSM in Linux 4.16 is DEVFREQ support for controlling the GPU clock frequency.

  • The Linux Foundation Announces New Linux on Azure Training Course [Ed: The Linux Foundation works for Microsoft now. Corrupted by the money. Microsoft meanwhile attacks Linux with patents.]
  • Automotive Grade Linux gets support from Toyota and Amazon as it eyes autonomous driving

    Open-source software was once something that large businesses shied away from, but over the course of the last few years, it’s made inroads into virtually every enterprise company. With Automotive Grade Linux (AGL), the Linux Foundation hosts a project that aims to bring open source to the car industry. As the AGL group announced at CES in Las Vegas today, Toyota and Amazon have now signed up to support the project, as well.

    Toyota, which is using AGL in the 2018 Camry, is joining as a platinum member, while Amazon opted for the silver level. Indeed, you may have seen another Toyota and Amazon mashup today, which is probably no coincidence.

  • R600 Gallium3D Gets More Fixes, Experimental SB Tessellation Support

    If you are still running with a pre-GCN AMD graphics card, a number of R600 Gallium3D commits landed in Mesa Git over night as well as an interesting patch series on the Mesa mailing list.

    Hitting Mesa 17.4-dev Git a few hours ago were a number of R600 Gallium3D fixes. This time around the various fixes come courtesy of VMware's Roland Scheidegger, a long time Mesa developer. They are a variety of minor fixes. It's nice to see nevertheless as R600g doesn't get too much action these days.

  • xf86-video-intel Gets Coffee Lake Support

    The xf86-video-intel DDX driver now has support for the first "Coffee Lake" processors.

  • The Current CPU Driver Usage Difference Between RADV/RadeonSI & NVIDIA

    Yesterday I posted some fresh GPU/driver benchmark results for discrete AMD Radeon and NVIDIA GeForce graphics cards. These were some of the most competitive numbers yet we've seen out of the open-source RadeonSI OpenGL and RADV drivers while using the latest Linux 4.15 kernel, especially for the GTX 1060 vs. RX 580 battle. In the comments were requests to see some CPU utilization numbers, including from one of the Radeon Linux developers, so here is a look at how the CPU usage compares.

    With having some spare cycles this morning on that Core i7 8700K "Coffee Lake" desktop, I ran a CPU usage comparison with various Linux games when using the Radeon RX 580 (on Linux 4.15 + Mesa 17.4-dev + LLVM 6.0 SVN) vs. the comparable GeForce GTX 1060 (on Linux 4.15 + NVIDIA 390.12) for showing the latest CPU utilization difference for both OpenGL and Vulkan games.

  • RADV Vulkan Driver Now Supports VK_EXT_discard_rectangles

    RADV co-founder Bas Nieuwenhuizen has landed support for the Vulkan VK_EXT_discard_rectangles extension within Mesa 17.4-dev.

  • RADV Gets Another Optimization For Micro-Benchmarks

    David Airlie and Bas Nieuwenhuizen's work on the RADV open-source Vulkan driver is quite relentless. David has posted yet another patch working on further optimizing the performance of this unofficial Radeon Vulkan driver living within Mesa.

  • The NVIDIA 390 Driver Is Playing Nicely With Linux 4.15 Kernel

    For those NVIDIA Linux users reliant upon the proprietary driver and wanting to upgrade to the Linux 4.15 kernel that will be officially released within the next two weeks, the 390.12 driver is playing nicely.

    Earlier NVIDIA driver releases ran into compatibility issues with the Linux 4.15 interfaces following the merge window (not due to KPTI, as some other FUD previously passed around by others). But with last week's NVIDIA 390.12 beta it has been working fine atop the Linux 4.15 Git kernel, including when Kernel Page Table Isolation is enabled for Meltdown prevention. (Retpoline support has yet to be mainlined, haven't tested the NVIDIA driver there yet to formally confirm if any breakage may happen.)

  • AMDGPU Queues More Fixes For Linux 4.16

    AMD sent in a fair number of AMDGPU updates slated for Linux 4.16 but now hitting the cut-off for major feature updates for DRM-Next code looking to make it into 4.16, AMD has submitted some fixes.

Games: Endless Horde, ERSATZ, Spartan Fist, Stellaris: Apocalypse, Feral Interactive, Unity (Mono)

Filed under
Gaming
  • Endless Horde is a Tower Defense game about protecting your base from a Zombie invasion

    I thought Endless Horde [Steam] looked like it could be a nice Tower Defense game to kill a few minutes since it's cheap, so I took a look.

    Developed by Ominous Entertainment, the game released with Linux support in April of last year. I let it bake a little longer, but even after waiting this long it's not great.

  • ERSATZ, a fast-paced hardcore action platformer with a musical twist adds Linux support

    Can't get enough hardcore platforming? Good news for you, as the colourful and musical ERSATZ [Steam, Official Site] now supports Linux.

    Originally released for Windows back in September of last year, the Linux version arrived two days ago. The developer said it does have two small differences to the Windows build, one being the "L" key being used to dash and a "shockwave" effect when you slam-hit the ground had to be removed due to graphical issues.

  • First-person puncher roguelike 'Spartan Fist' sounds hilarious and it's coming to Linux

    Spartan Fist [Steam, Official Site], a first-person puncher roguelike from Glass Bottom Games looks fantastic and the good news is that it's heading to Linux.

    It's really great to know that Glass Bottom Games will continue to support Linux, as they previously released Jones On Fire and Hot Tin Roof: The Cat That Wore A Fedora so I was hoping they would. Spartan Fist actually features two characters from those previous games too, but you won't need to play them to enjoy this.

  • Stellaris: Apocalypse expansion announced, prepare to fire the Colossus!
  • Game Porter Feral Interactive Is Up To Around 72 Employees

    For those curious about the financial aspect of porting games to Linux and macOS, Feral Interactive has published their 2017 fiscal year results.

    Well known Linux game porting company Feral Interactive that also brings games to macOS/iOS has filed their latest financial data this week with UK's Companies House for their fiscal year ending 31 March 2017.

  • Unity 2018.1 Introducing A "Scriptable Render Pipeline"

    Unity Technologies has rolled out their first public beta for the Unity 2018.1 release. Exciting us about this game engine update is their Scriptable Render Pipeline.

    The Scriptable Render Pipeline is their new real-time rendering architecture. Scriptable Rendering Pipeline (SRP) is still being developed but is designed to exploit the potential of modern systems, particularly GPUs, and to do so in an easy and efficient manner. SRP is designed to be extensible and can be extended/customized using C# code and material shaders.

Mozilla Leftovers

Filed under
Moz/FF
  • Mozilla Release Management Team: Firefox Release management at FOSDEM 2018
  • Mozilla Reps Community: Reps Council at Austin

    The All Hands is a special time of the year where Mozilla employees along with core volunteers gather for a week of many meetings and brainstorming. The All Hands Wiki page has more information about the general setting. During the All Hands, the Reps Council participated in the Open Innovation meetings as well as had meetings about what 2018 planning. One of our main topics was about the Mission Driven Mozillians proposal.

  • Announcing ESR60 with policy engine

    The Firefox ESR (extended support release) is based on an official release of Firefox desktop for use by organizations including schools, universities, businesses and others who need extended support for mass deployments. Since Firefox 10, ESR has grown in popularity and many large organisations rely on it to let their employees browse the Internet securely.

    We want to make customization of Firefox deployments simpler for system administrators and we’re pleased to announce that our next ESR version, Firefox 60, will include a policy engine that increases customization possibilities and integration into existing management systems.

  • Web. Period.

    Seen from here, EPUB is a technical dead end. The ebook market just cannot absorb newer versions of EPUB any more, and I’m not sure when it will be able to absorb even light incremental changes again. EPUB books based on EPUB 3.0.1 or a light and for once backwards-compatible evolution of 3.0.1, are here to stay for a very, very long time.

  • User Style for bugzilla.mozilla.org

    Yesterday, I was talking with Kohei Yoshino (the person behind the Bugzilla Quantum effort that recently landed significant UX improvements to the header strip) about some visual issues I have on bugzilla.mozilla.org which basically boil down to our default view being a bit too noisy for my taste and not emphasizing enough on the key elements I want to glance at immediately when I visit a bug (bug Status, description, comments).

    Given that I spend a significant amount of time on Bugzilla and that I also spend some time on Github issues, I decided to see if I could improve our default theme on Bugzilla with a user style to make it easier on the eyes and also closer visually to Github, which I think is good when you use both on a daily basis.

PiTalk, Gemini PDA, and Eelo take different paths to the Linux phone

Filed under
Linux
Hardware

The PiTalk is an RPi phone add-on board. The Gemini PDA is a clamshell re-spin of the Psion. Eelo is a privacy-oriented phone ROM. Samsung is planning to load Ubuntu desktops on Galaxy phones. They all want to reinvent the Linux phone concept.

Since our September story surveying a new crop of Linux smartphone contenders, including the Raspberry Pi based ZeroPhone and Purism’s Librem 5, we’ve seen several more Linux phone projects pop into view. New entries covered here include a successfully Kickstarted PiTalk phone add-on for the Raspberry Pi. There’s also a Gemini PDA with 4G support that dual-boots Linux and Android. It won Indiegogo funding last year and has now opened for additional orders.

Read more

Also: Tiny solderable quad Cortex-A17 module has 4GB RAM and HDMI 2.0

Fedora Development and Red Hat's Stock

Filed under
Red Hat

Android's Competition is Explosive

Filed under
Mac
  • Second iPhone battery explodes at Apple Store in Europe - this time in Spain

    The explosion occurred at Apple's Calle Colón Store in Valencia, Spain. According to a report in Las Provincias, the battery overheated while being worked upon and started emitting smoke, triggering immediate evacuation from the building. An entire floor in the building was engulfed in smoke, one of the first responders at the site reported.

  • Another iPhone Battery Explodes Right in the Apple Store

    It’s a tough time for Apple Store staff across the world, not only because iPhone owners rush to change their worn-out batteries as part of the $29 discount program, but also due to some batteries actually catching fire right when being serviced.

    It happened earlier this week in Zurich, when an iPhone battery started emitting smoke all of a sudden, and now the same thing took place in Spain at Apple’s store in Valencia.

    A report from local newspaper LasProvincias reveals that the iPhone battery hasn’t just emitted smoke, but it actually exploded, leading to the entire floor being filled with smoke.

    This obviously triggered the store evacuation given the risks of smoke intoxication, and firefighters and police rushed to the scene. Emergency services, however, weren’t required to intervene because Apple Store staff managed to vent the building by opening all windows and to cover the faulty battery with sand. No injuries were caused to Apple employees or store visitors.

Security: Meltdown, Spectre, Apple, CoffeeMiner, EMC, VMware and More

Filed under
Security
  • NSA Didn't Know of Meltdown, Spectre, Trump Cyber Czar Says

    The National Security Agency didn't know about the Meltdown or Spectre flaws, White House cybersecurity coordinator Rob Joyce said at the International Conference on Cyber Security at Fordham University Law School here today (Jan. 11).

  • spectre and the end of langsec

    Like many I was profoundly saddened by this analysis. I want to believe in constructive correctness, in math and in proofs. And so with the rise of functional programming, I thought that this historical slide from reason towards observation was just that, historical, and that the "safe" languages had a compelling value that would be evident eventually: that "another world is possible".

    In particular I found solace in "langsec", an approach to assessing and ensuring system security in terms of constructively correct programs. One obvious application is parsing of untrusted input, and indeed the langsec.org website appears to emphasize this domain as one in which a programming languages approach can be fruitful. It is, after all, a truth universally acknowledged, that a program with good use of data types, will be free from many common bugs. So far so good, and so far so successful.

    The basis of language security is starting from a programming language with a well-defined, easy-to-understand semantics. From there you can prove (formally or informally) interesting security properties about particular programs. For example, if a program has a secret k, but some untrusted subcomponent C of it should not have access to k, one can prove if k can or cannot leak to C. This approach is taken, for example, by Google's Caja compiler to isolate components from each other, even when they run in the context of the same web page.

    But the Spectre and Meltdown attacks have seriously set back this endeavor. One manifestation of the Spectre vulnerability is that code running in a process can now read the entirety of its address space, bypassing invariants of the language in which it is written, even if it is written in a "safe" language. This is currently being used by JavaScript programs to exfiltrate passwords from a browser's password manager, or bitcoin wallets.

  • Is Apple Even Paying Attention To macOS Security Anymore?

    A new Mac security flaw lets you type literally any username and password in order to unlock the Mac App Store panel in System Preferences. It’s probably not a big deal practically speaking—the panel is unlocked by default—but the fact that this issue exists at all is a worrying reminder that Apple isn’t prioritizing security like they used to.

  • Ubuntu Linux Unbootable After Users Install Meltdown And Spectre Patches
  • Ubuntu Update For Meltdown And Spectre Chip Flaws Leaves Some PCs Unbootable

    Sometimes the cure is worse than the disease. Just ask the affected users of older AMD systems who had their PCs bricked after downloading and installing a Windows update that was supposed to protect them from Meltdown and Spectre. It is not just Windows users who are suffering, either. Some Ubuntu Xenial 16.04 users also report that the latest update for their OS has rendered their system unable to boot.

  • How CoffeeMiner Attack Hacks Public Wi-Fi And Uses Your PC For Mining Cryptocurrency

    After a series of ransomware attacks capturing the headlines past year, crypto mining malware and cryptojacking attacks came into the play. Just last month, a Starbucks customer found that the infected Wi-Fi hotspot was trying to mine Monero digital coins. It was a new kind of threat associated with using public hotspots, which are often labeled unsafe and users are advised to use VPN services for extra privacy.

  • Prosecutors say Mac spyware stole millions of user images over 13 years

    An indictment filed Wednesday in federal court in Ohio may answer some of those questions. It alleges Fruitfly was the creation of an Ohio man who used it for more than 13 years to steal millions of images from infected computers as he took detailed notes of what he observed.

  • EMC, VMware security bugs throw gasoline on cloud security fire

    While everyone was screaming about Meltdown and Spectre, another urgent security fix was already in progress for many corporate data centers and cloud providers who use products from Dell's EMC and VMware units. A trio of critical, newly reported vulnerabilities in EMC and VMware backup and recovery tools—EMC Avamar, EMC NetWorker, EMC Integrated Data Protection Appliance, and vSphere Data Protection—could allow an attacker to gain root access to the systems or to specific files, or inject malicious files into the server's file system. These problems can only be fixed with upgrades. While the EMC vulnerabilities were announced late last year, VMware only became aware of its vulnerability last week.

  • Malware based on open source Kotlin language discovered lurking in Google Play [Ed: This has nothing to do with "open source". They don't say "proprietary" when the framework is.]

    Basically, it's pretty typical of the malware that crops up in dodgy apps that have wormed their way past the digital bouncers on the Play Store.

  • How to increase Linux security by disabling USB support

    This may sound like a crazy way of enhancing security on a server, but if you can get away with it—as in you don't need any USB devices such as keyboards, mice, external drives—disabling USB support can be an added means of ensuring malicious files do not find their way onto your servers. Obviously, this will only work for headless machines, so you better make certain you can SSH into those servers, otherwise, you'll find yourself in trouble trying to input anything via keyboard or mouse.

OPNsense® 18.1 Release Candidate 1

Filed under
Security
BSD

For more than 3 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.

We humbly present to you the sum of another major iteration of the OPNsense firewall. Over the second half of 2017 well over 500 changes have made it into this first release candidate. Most notably, the firewall NAT rules have been reworked to be more flexible and usable via plugins, which is going to pave the way for subsequent API works on the core firewall functionality. For more details please find the attached list of changes below.

Meltdown and Spectre patches are currently being worked on in FreeBSD[1], but there is no reliable timeline. We will keep you up to date through the usual channels as more news become available. Hang in there!

Read more

KDE: KStars, Nextcloud Talk, Akademy, Krita, Qt, Kdenlive

Filed under
KDE
  • KStars 2.9.1 is off to a fantastic start in 2018!

    We're kicking off 2018 with a new fantastic release of KStars for Windows & MacOS. Linux users should wait a few more days to get the release in the official PPA due to Canonical's Launchpad downtime because of the Meltdown and Spectre CPU vulnerabilities discovered recently.

    KStars 2.9.1 aka "Lancaster" release is primarily a bugfix release, but it brings with it as well several new features and improvements to existing technologies.

  • Nextcloud Talk is here

    Today is a big day. The Nextcloud community is launching a new product and solution called Nextcloud Talk. It’s a full audio/video/chat communication solution which is self hosted, open source and super easy to use and run. This is the result of over 1.5 years of planing and development.

    For a long time it was clear to me that the next step for a file sync and share solution like Nextcloud is to have communication and collaboration features build into the same platform. You want to have a group chat with the people you have a group file share with. You want to have a video call with the people while you are collaborative editing a document. You want to call a person directly from within Nextcloud to collaborate and discuss a shared file, a calendar invite, an email or anything else. And you want to do this using the same login, the same contacts and the same server infrastructure and webinterface.

  • Akademy 2018 Call for Participation

    Akademy is the KDE Community conference. The 2018 edition is from Saturday 11th to Friday 17th August in Vienna, Austria. If you are working on topics relevant to KDE or Qt, this is your chance to present your work and ideas at the Conference. The days for talks are Saturday and Sunday, 11th and 12th. The rest of the week will be BoFs, unconference sessions and workshops.

  • Krita 4.0 Beta 1

    We’ve officially gone into String Freeze mode now! That’s developer speak for “No New Features, Honest”. Everything that’s going into Krita 4.0 now is in, and the only thing left to do is fixing bugs and refining stuff.

    Given how much has changed between Krita 3 and Krita 4, that’s an important part of the job! Let us here repeat a very serious warning.

  • Qt 3D Studio Remote Deployment on Android Devices
  • New in Qt 5.10: QThread::create
  • Kdenlive cafés #25 and #26 – Everybody is invited

KPTI + Retpoline Linux Benchmarking On Old Laptops

Filed under
Graphics/Benchmarks

Over the past week and a half of running many benchmarks looking at the performance impact of the Linux KPTI and Retpoline patches for Spectre and Meltdown mitigation, one of the most common test requests is some thorough benchmarks on older systems. Why that's important is with older (pre-Westmere) CPUs there isn't PCID (Process Context Identifier) support that's used by KPTI, which helps offset some of the performance loss. So for some test results to share today are two old ThinkPads from the Clarksfield and Penryn days compared to a newer Broadwell ThinkPad in looking at the performance difference.

Read more

Multimedia Apps for the Linux Console

Filed under
Linux

When last we met, we learned that the Linux console supports multimedia. Yes, really! You can enjoy music, movies, photos, and even read PDF files without being in an X session with MPlayer, fbi, and fbgs. And, as a bonus, you can enjoy a Matrix-style screensaver for the console, CMatrix.

You will probably have make some tweaks to your system to make this work. The examples used here are for Ubuntu Linux 16.04.

Read more

Syndicate content

More in Tux Machines

KWin/X11 is feature frozen

Yesterday the KDE Community released the Beta for Plasma 5.12 LTS. With that release the feature freeze for 5.12 is in place and also an eternal feature freeze for KWin/X11. To quote the release announcement: “5.12 is the last release which sees feature development in KWin on X11. With 5.13 onwards only new features relevant to Wayland are going to be added.” This raised quite some questions, concerns and misunderstandings in the social networks. With this blog post I try to address those question and explain why this change in policy is done. Read more Also: KDE's KWin Now Considers Its X11 Code To Be Under An "Eternal Feature Freeze"

Plasma 5.12 LTS beta available in PPA for testing on Artful & Bionic

Adventurous users, testers and developers running Artful 17.10 or our development release Bionic 18.04 can now test the beta version of Plasma 5.12 LTS. Read more Also: Kubuntu 17.10 and 18.04 Users Can Now Try the KDE Plasma 5.12 LTS Desktop

Leftovers: Proprietary Software, HowTos, and GXml

Debian Developers: Google Summer of Code, Quick Recap of 2017

  • RHL'18 in Saint-Cergue, Switzerland
    In between eating fondue and skiing, I found time to resurrect some of my previous project ideas for Google Summer of Code. Most of them are not specific to Debian, several of them need co-mentors, please contact me if you are interested.
  • Quick recap of 2017
         After the Stretch release, it was time to attend DebConf’17 in Montreal, Canada. I’ve presented the latest news on the Debian Installer front there as well. This included a quick demo of my little framework which lets me run automatic installation tests. Many attendees mentioned openQA as the current state of the art technology for OS installation testing, and Philip Hands started looking into it. Right now, my little thing is still useful as it is, helping me reproduce regressions quickly, and testing bug fixes… so I haven’t been trying to port that to another tool yet. I also gave another presentation in two different contexts: once at a local FLOSS meeting in Nantes, France and once during the mini-DebConf in Toulouse, France. Nothing related to Debian Installer this time, as the topic was how I helped a company upgrade thousands of machines from Debian 6 to Debian 8 (and to Debian 9 since then). It was nice to have Evolix people around, since we shared our respective experience around automation tools like Ansible and Puppet.