This page permanently redirects to gemini://gemini.techrights.org/2018/01/05/elive-2-9-22-beta/.

● 01.05.18

● Links 5/1/2018: Elive 2.9.22 Beta, Ubuntu 17.10 Re-Released Next Week

Posted in News Roundup at 11:29 pm by Dr. Roy SchestowitzContentsGNU/LinuxGNU/Linux

Desktop

=> ↺ 7 Best Linux Distributions for Desktop/Laptop 2018

• This would be our first article in 2018 and happy to present you a list of the best Linux distributions to add to your favorite list in 2018 for your Desktop/Laptop, it is important to note that there is no such thing as “best” Linux distribution. People have different tastes which vary from UI experience to the feature set provided by a Linux distribution. As an example, a newbie will have a different preference from an advanced Linux administrator who has worked with a distribution like Gentoo and is obsessed with Linux CLI administration.

• If you’re not sure about a Linux distribution to use, It’s best to test them on VirtualBox or VMware Workstation, you’ll definitely fall for one that suits your needs and preferences.

=> ↺ Dell XPS 13 with Ubuntu — The Ultimate Developer Laptop of 2018!

• I’m the proud owner of a new Dell XPS 13 Developer Edition (9630) laptop, pre-loaded from the Dell factory with Ubuntu 16.04 LTS Desktop.

• Kudos to the Dell and the Canonical teams that have engineered a truly remarkable developer desktop experience. You should also check out the post from Dell’s senior architect behind the XPS 13, Barton George.

=> ↺ Dell releases Ubuntu Linux-based XPS 13 Developer Edition (9370) laptop

• If you want a computer pre-loaded with a Linux-based operating system, you can never go wrong with System76. After all, that company focuses entirely on Linux — it does not sell Windows machines at all. Hell, System76 even maintains its own Ubuntu-based operating system called Pop!_OS. By supporting that company, you are also supporting the overall Linux community.

• System76 is not the only company selling Linux-powered computers, however. Despite being a major Microsoft partner with Windows, Dell also sells desktops and laptops pre-loaded with Ubuntu. One of the company’s most impressive computers is the svelte XPS 13 laptop. Dell sells a version with Ubuntu that it dubs “Developer Edition,” but non-developers can, of course, use it too. Today, the company announces the the 7th-generation version of this notebook. The 9370, as it is called, can be purchased immediately.

=> ↺ Announcing the Dell XPS 13 Developer Edition 9370 with Ubuntu

• We’re excited to see Dell announce the availability of the 7th gen XPS 13 Developer Edition (9370) which comes preloaded with Ubuntu. Canonical have been part of Dell’s Project Sputnik project since Day 1, and five years later we are delighted to see it continue. In fact, our VP of Product Dustin Kirkland was one of the three original developers (or cosmonauts) who provided input into this project and has left some thoughts five years later in his blog.

=> ↺ Dell’s new XPS 13 – the ultimate Linux laptop?

• he new Dell XPS 13 (2018) is a compelling Ubuntu laptop. It has a smaller footprint, yet bigger performance. We look at the specs, price and release date.

Server

=> ↺ Twistlock 2.3 Advances Container Security with Serverless Support

• Container security vendor Twistlock released version 2.3 of its container security platform on Jan. 3, including new features to help protect container workloads.

• Among the new features in the Twistlock 2.3 release in an improved Cloud Native App Firewall (CNAF), per-layer vulnerability analysis functionality, application aware system call defense and new serverless security capabilities.

=> ↺ Amazon launches its own open-source OS ‘Linux 2′ for enterprise clients

• In a deviation from its earlier policy of not permitting its cloud services users to run operating systems on its clients’ servers, Amazon has since launched its own version of the Linux OS, according to a report in VCCircle. This move by Amazon Web Services is seen as a response to rivals Oracle and Microsoft who have been offering what is known as Hybrid technology to their clients in which the open platform OS Linux can be used by the clients availing cloud services to run many other programs, on their own severs as well as on the cloud.

• Up to now, Amazon did not provide this facility to its clients directly. Only the Amazon-owned data centers were permitted to run these OSs.

=> ↺ Five Linux Server Distributions to Consider in 2018

• These five tried-and-tested Linux server distributions top our list for distros to consider for the data center or server room.

=> ↺ Get Started with Spinnaker on Kubernetes

• In the last previous installment of the series, we introduced Spinnaker as the multicloud deployment tool. We will explore how to setup Spinnaker on the Kubernetes open source container orchestration engine and deploy your first application through it.

• In this tutorial, I will walk you through how to setup and configure Spinnaker on Minikube. Once it is up and running, we will deploy and scale a containerized application running in Kubernetes.

• Spinnaker is usually installed in a VM running Ubuntu 14.04 LTS. Thanks to the Helm community, it is now available as a Chart to install with just one command.

=> ↺ Know when to implement serverless vs. containers

• Serverless computing is either the perfect answer to an application deployment problem or an expensive disaster waiting to happen.

• VMs, containers and serverless architecture all have distinct pros and cons, but serverless might break everything if the applications aren’t suited for that deployment architecture. To prevent an implosion in IT, give developers an educated assessment of serverless vs. containers for new deployments.

=> ↺ Amazon counters hybrid cloud model with Linux 2: Amazon launches next Linux server OS

• Amazon Web Services (AWS) recently launched Linux 2, with access to the latest 4.9 LTS kernel. According to the company, the newest version “provides a high performance, stable, and secure execution environment for cloud and enterprise applications.” The system includes five years of long-term security support and access to software packages through the Amazon Linux Extras repository. It is currently available for all AWS regions.

Kernel Space

=> ↺ Linux 4.14.12

=> ↺ Linux 4.9.75

=> ↺ Linux 4.4.110

=> ↺ CES preview: Back to the future

• Toyota will showcase its Linux-based infotainment platform that will be included in the 2018 Camry. Automotive Grade Linux is an open-source project by The Linux Foundation, which is the official authority of one of the foundational programming languages for modern computing.

Linux Foundation

=> ↺ Hyperledger 3 years later: That’s the sound of the devs… working on the chain ga-a-ang

• The Linux Foundation’s Hyperledger project was announced in December 2015. When Apache Web server daddy Brian Behlendorf took the helm five months later, the Foundation’s blockchain baby was still embryonic. He called it “day zero.”

• Driving Hyperledger was the notion of a blockchain, a distributed ledger whose roots are in digital currency Bitcoin, for the Linux ecosystem – a reference technology stack that those comfortable with a command line could experiment with and build their own blockchain systems and applications.

• Behlendorf, the project’s executive director, said upon assuming command in May 2016: “There are lots of things that we want to see built on top.”

Graphics Stack

=> ↺ AMD Posts Last KFD Kernel Patches For Discrete GPUs, Needed For Upstream ROCm

• AMD has posted their remaining patches for now for getting the discrete GPU support upstream in the AMDKFD “Kernel Fusion Driver” that is part of their ROCm compute stack.

=> ↺ Xilinx ZynqMP DisplayPort DRM/KMS Driver Posted

• Xilinx is interested in contributing the latest DRM/KMS driver upstream.

• Xilinx has developed a new DRM/KMS driver for their DisplayPort sub-system that is part of their ZynqMP SoC. The Xilinx ZynqMP SoC has a full display pipeline and two planes and DisplayPort 1.2 encoder.

=> ↺ Tessellation Shaders Land For RadeonSI NIR Backend

• The work led by Valve Linux driver developer Timothy Arceri on adding tessellation shader support to RadeonSI’s NIR code-path has been merged to Mesa 17.4-dev Git.

• RadeonSI Gallium3D has been working on a NIR back-end for eventually supporting SPIR-V ingestion as needed for OpenGL 4.6 compliance with code sharing with the RADV Vulkan code. Eventually though RadeonSI may eventually switch to using NIR completely as its intermediate representation. But before that can happen, the RadeonSI NIR support needs to get to parity with its existing OpenGL support when tied to TGSI IR.

=> ↺ Broadcom’s Open-Source VC5 OpenGL & Vulkan Support Improving

• Broadcom open-source driver developer Eric Anholt has written his first status update on the VC5 driver activities of the new year.

• VC5 is the new Broadcom GPU capable of Vulkan and much greater OpenGL capabilities than the VC4 graphics processor most well known for being within current-generation Raspberry Pi devices. Eric has been working on the bring-up of the open-source VC5 driver stack for the past half-year and he continues making progress on getting the VC5 OpenGL Gallium3D driver closer to parity to the long-standing VC4 driver as well as working on “BCMV” as the new Broadcom Vulkan driver still in its early stages.

=> ↺ NVIDIA Mainlining Tegra186 DRM Support For Linux 4.16

• Nearly one year after rolling out the Jetson TX2 developer board with the “Tegra186″ SoC, the Tegra DRM driver in Linux 4.16 will finally be offering basic display support with this open-source driver.

• NVIDIA has finished prepping the Tegra186 support for their Tegra DRM driver, which is around 4,000 lines of new code or a net gain of 2k. But at this stage the Tegra DRM driver for Linux 4.16 will only support driving displays via HDMI with Tegra186 as DisplayPort and DSI interfaces have yet to be implemented in the driver for this latest SoC.

Benchmarks

=> ↺ Linux KPTI Tests Using Linux 4.14 vs. 4.9 vs. 4.4

• Yet another one of the avenues we have been exploring with our Linux Page Table Isolation (KPTI) testing has been looking at any impact of this security feature in the wake of the Meltdown vulnerability when testing with an older Linux Long Term Support (LTS) release. In particular, when using a kernel prior to the PCID (Process Context Identifier) support in the Linux kernel that is used to lessen the impact of KPTI.

Applications

=> ↺ Gammu release day

• I’ve just released new versions of Gammu, python-gammu and Wammu. These are mostly bugfix releases (see individual changelogs for more details), but they bring back Wammu for Windows.

• This is especially big step for Wammu as the existing Windows binary was almost five years old. The another problem with that was that it was cross-compiled on Linux and it always did not behave correctly. The current binaries are automatically produced on AppVeyor during our continuous integration.

Proprietary

=> ↺ Opera 50 Debuts as World’s First Web Browser with Anti-Bitcoin Mining Protection

• Opera Software released today the Opera 50 web browser for GNU/Linux, macOS, and Windows systems, a major release that comes with innovative new features and dozens of improvements.

• Based on Chromium 63.0.3239.108, Opera 50 appears to be the only major web browser that promised to protect your computer against Bitcoin mining. Dubbed NoCoin, the anti-Bitcoin mining protection has been implemented in Opera’s integrated ad blocker, which can be easily enabled in Settings under the Recommended lists of ad filters of the Block ads option.

Instructionals/Technical

=> ↺ Allowing OCSP stapling in Apache Web Server with SELinux policies

=> ↺ Space is not released after deleting files in Linux?

=> ↺ How to Change Your IP Address From the Command Line in Linux

=> ↺ g_object_ref and -Wincompatible-pointer-types

• I proposed a change to GObject that was merged not too long ago that uses typeof on GCC/Clang to propagate the pointer type from the parameter.

=> ↺ What To Do After Installing Trisquel 8 “Flidas”

• This recommendation article is for you first-timers & beginners who use Trisquel 8 “Flidas” GNU/Linux. If you just switched from MS Windows to Trisquel, then this is for you. Here you’ll find suggestions in setting the desktop, changing the theme, adding applications, knowing useful browser addons, and seeing a short list of good applications you can install on Trisquel. In case this maybe interesting, you also can customize the Terminal appearance so it looks more cool that way. Finally, this article wished to make your first days with Trisquel easy and happy.

=> ↺ Linux paste Command Explained For Beginners (5 Examples)

=> ↺ Learn to use Wget command with 12 examples

=> ↺ Using split ssh in QubesOS 4.0

=> ↺ How to assign static ip address in Ubuntu 17.10 (Artful Aardvark)

=> ↺ TLP – Quickly Increase and Optimize Linux Laptop Battery Life

=> ↺ How to Get the Pixel 2’s Portrait Mode on Your Nexus or Pixel Phone

=> ↺ How To Display Asterisks When You Type Password In terminal

=> ↺ How to add EBS disk on AWS Linux server

=> ↺ Tlog – A Tool to Record / Play Terminal IO and Sessions

=> ↺ How to Install Icinga 2 and Icinga Web 2 on Debian 9.3

=> ↺ How to write pylint checker plugins

=> ↺ Ansible: the Automation Framework That Thinks Like a Sysadmin

=> ↺ How to Download Packages without Installing on RPM Distros

=> ↺ HTTP errors in WordPress

=> ↺ WordPress 500 Internal Server Error

Wine or Emulation

=> ↺ Wine Performance May Be Impacted By Linux KPTI Patches

• Besides VM performance and databases and heavy I/O taking a performance hit in the “Kernel Page Table Isolation” patches in the wake of the Spectre and Meltdown attack, it looks like Wine’s performance may also be impaired.

• Phoronix reader “R00KIE” pointed out that one of the page table isolation patches does mention a possible performance hit for Wine.

=> ↺ Wine Takes Minor Performance Hit Running Windows Programs On Linux With KPTI

• With word this morning that Wine performance may be impacted by the Linux KPTI patches stealing the spotlight this week, I ran some basic benchmarks of Wine in different configurations looking at the performance impact of the kernel page table isolation patches.

=> ↺ Wine Announcement

• The Wine development release 3.0-rc5 is now available.

=> ↺ Wine 3.0-RC5 Released With More Bug Fixes

• We are stepping closer to the official Wine 3.0 release but not quite there yet though it’s looking like it could be here within the next week or two.

• Coming out today is the fifth weekly release candidate ahead of Wine 3.0.0. Wine 3.0-RC5 has just nine known bug fixes ranging from taking care of issues with Slingplayer 2.0 to Eclipse Europa to Regedit problems.

Games

=> ↺ Critical Annihilation is an explosion-heavy and stupidly fun twin-stick shooter

• Critical Annihilation is a twin-stick shooter where every single thing is made out of tiny blocks, it also happens to be an incredibly satisfying experience.

=> ↺ Sci-fi first-person exploration game ‘The Station’ launch delayed, Linux at release confirmed

• The Station [Steam, Official Site] is an upcoming sci-fi first-person exploration game surrounding the discovery of a sentient alien civilization, it’s had a slight release delay but the good news is that Linux will be a same-day release.

=> ↺ We have over 150 beta keys of the co-op MMO ‘Dead Maze’ to give away

=> ↺ Valve Kicks Off 2018 with Massive SteamOS Beta Update, Adds Linux Kernel 4.14

• Valve is kicking off 2018 with a new beta update of its Debian-based SteamOS gaming operating system that adds some of the latest GNU/Linux technologies.

• Powered by the Linux 4.14.3 kernel and using the Mesa 17.2.4 graphics stack for Intel and AMD Radeon GPUs, as well as the Nvidia 387.22 proprietary graphics driver for Nvidia GPUs, the SteamOS 2.141 Beta update is apparently a massive and complex one that updates numerous components like libdrm, libglvnd, and glx-alternatives to support new graphics drivers.

• “Happy New Year, SteamOS fans! We are kicking off 2018 with a massive SteamOS beta update. This includes a new 4.14 Linux kernel, Nvidia 387.22 graphics driver, and Mesa 17.2.4 for AMD and Intel,” says John Vert. “This is a very large and complex update. Please let us know if you find any problems updating or any regressions, particularly around hardware support or graphics.”

=> ↺ Valve Ships Its First SteamOS Brewmaster Beta Of 2018

• While SteamOS has felt like it’s just been on life-support the past year, Valve is starting off 2018 by a fairly sizable SteamOS Brewmaster Beta update.

• This latest beta of their Debian-based Linux gaming OS update is mostly about bringing their packages up-to-date. This update issued on Friday upgrades to the Linux 4.14 kernel, NVIDIA 387.22 driver, and Mesa 17.2.4. These are some fairly big updates compared to their older versions although a pity Mesa 17.3 (or even 17.4-dev Git) isn’t used.

=> ↺ The Talos Principle going Fusion, Croteam dropping OpenGL & Serious Sam 4 still coming

• A bit of Croteam news to start the day with and there’s multiple interesting items to go over in regards to their games.

• I love how active Croteam are with their community, they’re constantly replying to all sorts of random questions from players of their games. Thanks to this, we’ve been able to learn a few things about their plans.

• Firstly, their fantastic puzzle game The Talos Principle is going to be moving over to their newer Fusion engine, they said it will be “Hopefully very soon”. The VR version is actually already on it, so that’s not surprising.

=> ↺ The 25 Coolest Linux Games of 2017

• The last time we compiled a list of Linux Games was approximately 10 months ago back in 2017 – The 25 Best Games for Linux and Steam Machines. Since we’re in 2018 it is only fair that we compile another list Linux gamers can refer to as they prepare to storm Steam’s (and other game services’) servers.

• The games are listed in no particular order; And even though some of them featured on the previous list I advise you to check that one out here before proceeding.

=> ↺ Like Roguelikes? How about Tower Defense? Dead Ground merges them together

• Another night endlessly browsing for new Linux games and I came across Dead Ground [Steam], a game that blends a Roguelike with Tower Defense.

=> ↺ An interview with the developer of space sim Helium Rain who says ‘Linux gaming is alive and well’

• I love space, I love how mysterious and dangerous it is and to be able to fly around in a game like Helium Rain [Steam] is fantastic. I decided to have a chat with the developer and they’re very positive about Linux gaming.

• We’ve covered Helium Rain here a few times before, so hopefully some of you will be familiar with it. Without further rambling, let’s begin!

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

=> ↺ Babe Music Player Is Getting a Mobile-Friendly Qml Port

• It’s been almost a year since I publicly stood in front of you all to coo over the Qt-based Babe music player — and now I’m back to coo at it some more.

• You can blame Babe developer Camilo Higuita. He’s shared a new video of his app that has me excited. The clip, which is embedded above, demos the ‘initial work’ he’s made on a Qml port of the Babe that uses Kirgami.

Distributions

=> ↺ The Best Linux Distributions for 2018

• It’s a new year and the landscape of possibility is limitless for Linux. Whereas 2017 brought about some big changes to a number of Linux distributions, I believe 2018 will bring serious stability and market share growth—for both the server and the desktop.

• For those who might be looking to migrate to the open source platform (or those looking to switch it up), what are the best choices for the coming year? If you hop over to Distrowatch, you’ll find a dizzying array of possibilities, some of which are on the rise, and some that are seeing quite the opposite effect.

• So, which Linux distributions will 2018 favor? I have my thoughts. In fact, I’m going to share them with you now.

• Similar to what I did for last year’s list, I’m going to make this task easier and break down the list, as follows: sysadmin, lightweight distribution, desktop, distro with more to prove, IoT, and server. These categories should cover the needs of any type of Linux user.

• With that said, let’s get to the list of best Linux distributions for 2018.

Red Hat Family

=> ↺ CentOS Linux Receives Security Updates Against Meltdown and Spectre Exploits

• Free Red Hat clone CentOS Linux has received an important kernel security update that patches the Meltdown and Spectre exploits affecting billions of devices powered by modern processors.

=> ↺ Grab scales to meet business demands with open source IT automation and management

• By deploying Red Hat Ansible Tower, an enterprise open source IT automation and management solution, Grab increased its app uptime to 99.99%, reduced development and deployment time, and streamlined infrastructure management with role-based access and automated deployments. As a result, Grab’s users can access the app when needed, and its IT teams can ensure systems are stable and scale to match feature and user base growth.

=> ↺ Beta Testing in the Ever-Changing World of Automation

• The International Standards Organization (ISO) has been focused on the standards around quality versus usability over time. In 1998 ISO identified efficiency, effectiveness and satisfaction as major attributes of usability. In 1999 a quality model was proposed, involving an approach to measure quality in terms of software quality and external factors. In 2001 the ISO/IEC 9126-4 standard suggested that the difference between usability and the quality in use is a matter of context of use. ISO/IEC 9126-4 also distinguished external quality versus internal quality and defined related metrics. Metrics for external quality can be obtained only by executing the software product in the system environment for which the product is intended.

• This shows that without usability/human computer interaction (HCI) in the right context, the quality process is incomplete. The context referred to here is fundamental to a beta test where you have real users in a real environment, thereby making the case of the beta test stronger.

• Beta Testing Challenges

• Now that we know why beta testing is so very critical, let’s explore the challenges that are involved with a beta stage.

• Any time standards are included, including ISO/IEC 9126, most of these models are static and none of them accurately describe the relationship between phases in the product development cycle and appropriate usability measures at specific project milestones. Any standard also provides relatively few guidelines about how to interpret scores from specific usability metrics. And specific to usability as a quality factor, it is worth noting that usability is that aspect of quality where the metrics have to be interpreted.

=> ↺ OpenShift Commons Briefing #112: Kubernetes 1.9 Release Update with Derek Carr (Red Hat)

• In this briefing, Red Hat’s Derek Carr talks us through the recent Kubernetes 1.9 release features and functions and reviews what is in the works for release 1.10. The briefing is a great guide to the 1.9 Release which went out the door at the very end of 2017. The 1.9 release had a strong focus on fixing bugs, maturing existing features to beta or stable. For Kubernetes 1.9, “Stability” is a key feature with an emphasis on refining, polishing, scale, and tightening up production matters.

=> ↺ Red Hat’s Latest Nouveau Developer Posts Updated NIR Code

• Not only is RadeonSI working on NIR support but Red Hat has begun working on NIR support for the open-source NVIDIA “Nouveau” driver as part of a compute effort and possible Vulkan support in the future.

• As written about last month, longtime Nouveau contributor Karol Herbst has joined Red Hat and his first public-facing project is developing NIR support for Nouveau. In the original patch series Karol explained he’s working on NIR support for Nouveau in order to get SPIR-V (the Vulkan / OpenCL IR) support moving. Their expressed focus right now is on SPIR-V compute support but this would also be a step towards Vulkan for this open-source, reverse-engineered NVIDIA Linux graphics driver.

Finance

=> ↺ Alyeska Investment Group LP Has Cut Red Hat (RHT) Holding; Trimble (TRMB) Sellers Decreased By 25.66% Their Shorts

=> ↺ Red Hat Inc (RHT) Shares Sold by Sterling Capital Management LLC

=> ↺ Evercore ISI Boosts Red Hat (RHT) Price Target to $140.00

=> ↺ Red Hat (NYSE:RHT) Given Buy Rating at Oppenheimer

=> ↺ Red Hat, Inc. (NYSE: RHT) – Hot Stock in Focus

=> ↺ A New Kind of Stock Chart: Red Hat Inc (NYSE:RHT) Critical Pivot Points

Fedora

=> ↺ Fedora 28 To Work On Better VirtualBox Integration, Hardening Packages & Stronger Crypto

• With more developers returning to their activities after the holidays, feature work on Fedora 28 is heating up.

• Recently proposed for Fedora 28 include:

• VirtualBox Guest Integration – This is aobut having the VirtualBox guest drivers and tools ship by default in Fedora Workstation. This is part of an effort by Red Hat for getting more of the VirtualBox drivers mainlined in the Linux kernel. Basically if all goes well this means a smoother out-of-the-box experience when running Fedora on top of Oracle VM VirtualBox.

=> ↺ ABRT team: Link to FAF directly from Fedora Packages

=> ↺ Fedora 28 Taking To Modularizing Their Anaconda Installer

• When talking about the Fedora/RedHat Anaconda installer it still brings back bad memories from the Anaconda fallout a few years ago when they went through some painful transitions that also led to release delays. In 2018, Fedora/RedHat developers are taking up the initiative of modularizing the Anaconda installer.

• For the Fedora 28 release due out this spring, the plan is to split the Anaconda installer into several modules that in turn will communicate with eachother using a DBus API. The modularization effort sounds nice as long as it goes smoothly and doesn’t lead to any fallout like with past Anaconda overhaul initiatives (though admittedly Anaconda has been playing nicely the past number of releases and no complaints on my end currently).

Debian Family

Derivatives

=> ↺ Elive 2.9.22 beta released

• The Elive Team is proud to announce the release of the beta version 2.9.22 This new version includes:

• Keyboard typing to support special languages like Korean, Japanese, Chinese, Vietnamese. If you need an extra Ibus configuration contact us with the details needed Network access to your local machines using hostname.local Numpad always enabled option in installation Desktop right click is assigned to an amazing launcher Designs shadow fix, borders more white, less pixelated icons in menus, much improved menus and userfriendly, misc overall improvements Userfriendly better organized menus, more friendly icons and names, improved description for the dock launchers

Canonical/Ubuntu

=> ↺ Ubuntu will fix Meltdown and Spectre by January 9th

• Ubuntu, perhaps the most popular Linux distribution, on the desktop, which has multitudes of other distributions depending on it to send out security updates, has announced that it will update the kernels of all supported releases in order to mitigate the newly publicly disclosed Meltdown and Spectre vulnerabilities, by January 9th.

=> ↺ Ubuntu 17.04, the Last Release with Unity 7, Reaches End of Life on January 13

• Canonical announced today that it’s putting an end to the support offered by the Linux company for its Ubuntu 17.04 “Zesty Zapus” operating system next week on January 13.

• Launched last year on April 13, Ubuntu 17.04 was a powerful release, both inside and outside, running the latest (at that time) stable Linux 4.10 kernel series and shipping with an up-to-date graphics stack based on Mesa 17.0 and X.Org Server 1.19 series. It was also the last Ubuntu release to ship with the Unity 7 desktop by default.

• “As a non-LTS release, 17.04 has a 9-month support cycle and, as such, will reach end of life on Saturday, January 13th,” says Steve Langasek, Engineering Manager, Ubuntu Foundations at Canonical. “At that time, Ubuntu Security Notices will no longer include information or updated packages for Ubuntu 17.04.”

=> ↺ Ubuntu 17.04 (Zesty Zapus) reaches End of Life on January 13, 2018

=> ↺ Canonical Plans to Release Ubuntu 17.10 Respin ISOs for All Flavors Next Week

• Canonical announced on Friday that it plans to release the promised respin ISO images of the Ubuntu 17.10 (Artful Aardvark) operating system early next week on January 11.

• The announcement comes minutes after Canonical announced the end of life of its Ubuntu 17.04 “Zesty Zapus” operating system on January 13, 2018, saying that it’s beneficial to have Ubuntu 17.10 images available in the face of the impending EOL for Ubuntu 17.04, as users will need to upgrade their installations.

• Last month, several users reported broken BIOSes due to a bug in the Ubuntu 17.10 installation images. Laptops from Lenovo, Acer, and Toshiba were affected by the issue, which locked users out of their BIOS settings. The bug could make user’s system unbootable even if the image was booted in live mode.

=> ↺ Exceptional respins of Ubuntu 17.10 media; call for testing

=> ↺ Ubuntu 17.10 To Be Re-Released Next Week

Devices/Embedded

=> ↺ January 2018 catalog of hacker-friendly SBCs

• This catalog accompanies our January 2018 round-up of hacker-friendly SBCs. Here, we provide brief descriptions, specs, pricing, and links to further details for all 103 SBCs.

• Our January 2018 hacker-friendly single board computer round-up comprises three resources: an overview of recent SBC market trends; this catalog, which provides descriptions, specs, pricing, and links to related LinuxGizmos coverage and supplier product pages for all 103 SBCs; and a Google docs spreadsheet that tabulates the key features and pricing for all 103 boards. Links to all three parts of our round-up are in the box below.

=> ↺ Ringing in 2018 with 103 hacker-friendly SBCs

• Welcome to our latest biannual round-up of hacker-friendly single board computers that run Linux or Android. Included are a brief review of recent SBC market trends, a catalog with key features, specs, and pricing of each SBC, and a table comparing them all.

• Relative to our June report, which was accompanied by a reader survey co-sponsored with Linux.com, our latest hacker-friendly single board computer (SBC) round-up has grown from 98 to 103 boards. Although there’s no survey here, we invite your comments in the discussion area at the bottom of this post.

• There are three parts to this round-up: this post, which provides an overview of recent SBC market trends and discusses our latest crop of hacker-friendly SBCs in general terms; a catalog post with brief descriptions, specs, pricing, and links to related LinuxGizmos coverage and supplier product pages for all 103 SBCs; and a Google docs spreadsheet that tabulates key features and pricing for all 103 boards. Links to each are in the box below.

=> ↺ RISC-V Foundation Trumpets Open-Source ISAs In Wake Of Meltdown, Spectre

• The RISC-V Foundation says that no currently announced RISC-V CPU is vulnerable to Meltdown and Spectre and, in the wake of those bugs, stressed the importance of open-source development and a modern ISA in preventing vulnerabilities.

• In consumer computing, we usually only hear about two instruction set architectures (ISA): x86 and ARM. Classified as a complex instruction set, x86 dominates the desktop and server space. Since the rise of smartphones, however, reduced-instruction-set (RISC) ARM processors have dominated the mobile computing market. Beyond x86, there aren’t many complex instruction sets still in use, but there are still many relevant RISC designs despite ARM’s seeming ubiquity.

• The lesser known RISC-V ISA is among those being developed to take on ARM. It was created in the University of California, Berkeley and is unique because it’s open-source. The ISA is actively being worked on and is now overseen by the RISC-V Foundation, which includes companies such as AMD, Nvidia, Micron, Qualcomm, and Microsoft. An ISA alone doesn’t define a CPU design, though. RISC-V being open-source means that anyone is free to build their own CPU to implement the ISA, or their own compiler to build software that can run on RISC-V CPUs.

=> ↺ WHY RASPBERRY PI ISN’T VULNERABLE TO SPECTRE OR MELTDOWN

• Over the last couple of days, there has been a lot of discussion about a pair of security vulnerabilities nicknamed Spectre and Meltdown. These affect all modern Intel processors, and (in the case of Spectre) many AMD processors and ARM cores. Spectre allows an attacker to bypass software checks to read data from arbitrary locations in the current address space; Meltdown allows an attacker to read data from arbitrary locations in the operating system kernel’s address space (which should normally be inaccessible to user programs).

• Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use.

• To help us understand why, here’s a little primer on so

=> ↺ All Raspberry Pi Devices Are Immune to the Meltdown and Spectre Vulnerabilities

• Just in case you were wondering, Raspberry Pi Foundation founder Eben Upton confirmed today that none of the Raspberry Pi devices are affected by the recently disclosed Meltdown and Spectre vulnerabilities.

• Earlier this week, two major hardware bugs were unearthed in modern processors, affecting almost all devices powered by some CPUs from Intel, AMD, or ARM made in the past two decades. The Meltdown and Spectre vulnerabilities are considered the worst chip flaw ever discovered, putting billions of devices at risk of attacks.

=> ↺ You know what’s not affected by Meltdown or Spectre? The Raspberry Pi

• One or more of the security vulnerabilities disclosed this week affect nearly every modern smartphone, PC, and server processor. Intel processor are vulnerable to both Meltdown and Spectre attacks. AMD chips are vulnerable to Spectre attacks. And the ARM-based processors that are used in most modern smartphones can fall prey to a Spectre attack as well.

=> ↺ Hackable, Rockchip-based media player also offers NAS and retro gaming

• Cloud Media’s open source “Popcorn Hour Transformer Media Computer / NAS” computer is based on Pine64’s RK3328-based Rock64 SBC, and supports Linux and Android media player, NAS, and retro gaming.

• Cloud Media has spun a new variant of its Popcorn Hour media player that is open source in hardware and software thanks to its mainboard: Pine64’s open source, quad-core Cortex-A53 Rock64 SBC. It’s available in a Media Computer and NAS (network attached storage) version for the same price of $95.90 (2GB LPDDR3/16GB eMMC) or $115.90 (4GB/32GB), not counting SATA storage.

Tizen

=> ↺ Samsung Gear S4 could have the battery built into the watch strap

Android

=> ↺ New Open Source Mobile OS Puts Privacy Front and Center

• A renowned Linux innovator has developed a new mobile operating system, called “Project eelo,” in an effort to provide a level of data privacy that traditional Android and iOS devices fail to offer.

• The new eelo system will allow mobile phone users to regain control over their personal information at a price they can afford, said Gael Duval, who created Mandrake Linux back in 1998.

• Apple has become too expensive, too boring and is “going crazy with its products,” he said, while Google has “become too big” and is capturing too much information about what we do.

=> ↺ 11 Best Free Android Antivirus Apps To Keep Your Device Secured in 2018

=> ↺ Intel chip flaw: What Google, Android, Apple Mac and Windows users need to do to stay safe

=> ↺ Razer publishes an official list of 120Hz-optimized Android games

=> ↺ Old Android phones don’t slow down like iPhones, and we think we know why

=> ↺ Here’s your early look at the Nokia 6 (2018)

=> ↺ Malware Impersonates Uber App on Android to Steal Data

=> ↺ New Leaked Android Oreo Build for the Snapdragon Samsung Galaxy S8 Adds Dolby Atmos

=> ↺ An Android malware is targeting major banking apps like HDFC Bank, SBI, reveals Quick Heal

=> ↺ AndEX OS Now Lets You Run Android 8.1 Oreo with Windows 10 Launcher on Your PC

• Dubbed AndEX Oreo 8.1, the new build of Arne Exton’s Android x86_64 fork is the first to be based on Google’s Linux-powered Android 8.1 “Oreo” mobile operating system, allowing anyone to install and run Android Oreo on their personal computers.

• For those switching from Microsoft Windows 10 to this Linux-based alternative, AndEX Oreo 8.1 comes bundled with a Windows 10 Launcher that looks just like the real thing, but probably even slicker thanks to the improvements put by Google in Android Oreo.

Free Software/Open Source

=> ↺ Cable’s Open Source Flirtation Heats Up

• CableLabs , the heart of cable research and development, has created its own OpenStack platform called the SDN/NFV Application Development Platform and Stack project, or SNAPS for short. That in itself isn’t news — SNAPS has been around since 2016 — but the organization also introduced two related projects as part of its open source effort just three weeks ago. And CableLabs’ lead architect for wired technologies, Randy Levensalor, opened up even more recently about how his team’s approach differs from some of the NFV strategies undertaken by telecom operators when the virtualization craze first took hold.

Web Browsers

Mozilla

=> ↺ Mozilla & Mr. Robot – Insert Freedom Here

• A few weeks ago, Mozilla finally showed us its true skin. No more illusions about its feel-goodie world-loving efforts. Yet another shark in the pond, after its share of filthy dimes. One day, there will be a new browser, and it will be something nice and cool and unspoiled by greed just yet. That will be the moment when I say goodbye to Firefox. For now, it’s still the least annoying turd in the pile, and I’m exercising my rather futile civil duty to complain.

• In a world without real choice, the best you can do, short of a proper bloody revolution, is to bitch and moan and tell your story. Luckily, this seems to work well. If there’s one good use to social media, it’s blowing things out of proportion and making viral, tidal waves of feces. Harness that power. Fight back. Remember, there IS such a thing as bad publicity. When it hits their pocket, you know you’re on the right track. So once again, thank you Mozilla for molesting my browser. Stay fake.

=> ↺ Mozilla statement on breach of Aadhaar data

• Mozilla is deeply concerned about recent reports that a private citizen was able to easily access the private Aadhaar data of more than one billion Indian citizens as reported by The Tribune.

• [...]

• Mozilla has been raising concerns about the security risks of companies using and integrating Aadhaar into their systems, and this latest, egregious breach should be a giant red flag to all companies as well as to the UIDAI and the Modi Government.

=> ↺ Lessons from the impl period

=> ↺ Looking back at Bugzilla and BMO in 2017

• Recently in the Bugzilla Project meeting, Gerv informed us that he would be resigning, and it was pretty clear that my lack of technical leadership was the cause. While I am sad to see Gerv go, it did make me realize I need to write more about the things I do.

Databases

=> ↺ The State of VACUUM

• In a recent blog post, I talked about why every system that implements MVCC needs some scheme for removing old row versions, and how VACUUM meets that need for PostgreSQL. In this post, I’d like to examine the history of VACUUM improvements in recent years, the state of VACUUM as it exists in PostgreSQL today, and how it might be improved in the future.

• When I first began using PostgreSQL, autovacuum did not exist, and I was not aware of the need for manual VACUUM. After a few months (!), I wondered why my database was so slow. Putting a vacuumdb command in cron, scheduled to run every 6 hours, was sufficient for my needs at the time, but it only worked because my database was small and handled a limited amount of traffic. In many environments, UPDATE and DELETE operations will target some tables much more often than others, and therefore some tables will accumulate dead row versions much more quickly than others, and therefore the interval between one VACUUM and the next should also vary. If a user with this kind of environment were to run a full-database VACUUM frequently enough to meet the needs of their most heavily-updated tables, they would VACUUM lightly-updated tables far more often than necessary, wasting effort. If they were to reduce the frequency of the full-database VACUUM to avoid wasting effort, heavily updated tables wouldn’t get vacuumed often enough and their on-disk size would grow as they filled up with dead row versions, otherwise known as “bloat”.

CMS

=> ↺ 3 flexible tools for managing hotel reservations and more

• Rezgo is a web-based reservation system that’s designed specifically for tour and activity operators. It provides tour management solutions (such as online booking engines) and supports integration with popular booking engines such as Expedia and Travel Advisor. Rezgo focuses on increasing business efficiency, with no limits on users, bookings, or features for its products. Rezgo’s open source booking engine is available for inspection and download at GitHub. It is built with PHP using the Twitter Bootstrap CSS framework and AJAX. You’ll find Rezgo easy to work with if you’re comfortable with XML API development, PHP, AJAX, and CSS.

Education

=> ↺ A school in India defies the traditional education model

• Located in a sleepy village just two hours away from the bustling metropolis of Mumbai is a school that defies traditional educational models by collaboratively owning, building, and sharing knowledge and technology. The school uses only open source software and hardware in its approach to learning, and takes pride in the fact that none of its students have used or even seen proprietary software, including the ubiquitous Windows operating system.

• The Tamarind Tree School, located in Dahanu Taluka, Maharashtra, India, is an experiment in open education. Open education is a philosophy about how people produce, share, and build on knowledge and technology, advocating a world in which education is for social good, and everyone has equal opportunity and access to education, training, and knowledge.

Pseudo-Open Source (Openwashing)

=> ↺ 20 years of the Open Source Initiative (OSI)

• No openwashing, thanks

• With so many vendors claiming to have ‘got the open religion’ but in fact doing nothing more than openwashing a few ‘less than key’ elements of their total technology stacks, the OSI says its next goals to promote open source’s viability/value to issues and look for areas where it can promote and champion implementation and what it calls ‘authentic participation’.

Funding

=> ↺ WP Engine Raises $250M to Grow WordPress Platform

• The open-source WordPress content management system has grown significantly over the last eight years and along with that growth, one of its leading backers, WP Engine, has also grown. On Jan. 4, WP Engine announced it raised a new $250 million round of funding from Silver Lake Partners.

• Silver Lake is well-known in the private equity world; not only did the firm work with Michael Dell to bring Dell Inc. private in 2013, but it also helped fund Dell’s acquisition of EMC in 2015. WP Engine was founded in 2010, with total funding to date now standing at $291 million.

Licensing/Legal

=> ↺ Enterprise Roles in Open Source Compliance

• There are generally two teams involved in achieving compliance: a core team and an extended team, with the latter typically being a superset of the former. The core team, often called the Open Source Review Board (OSRB), consists of three key representatives from engineering and product teams, one or more legal counsels, and the compliance officer/ open source program office manager.

Openness/Sharing/Collaboration

=> ↺ What you didn’t know about Creative Commons

• I attended film school, and later I taught at a film school, and even later I worked at a major film studio. There was a common thread through all these different angles of the creative industry: creators need content. Interestingly, one movement kept providing the solution, and that was free culture, or, as it has been formalized, Creative Commons.

Programming/Development

=> ↺ An introduction to Eclipse MicroProfile

• Enterprise Java has been defined by two players: Spring on one side and Java Enterprise Edition on the other. The Java EE set of specifications was developed in the Java Community Process under the stewardship of Oracle. The current Java EE 8 was released in September 2017; the prior version came out in 2013.

• Between those releases, the industry saw a lot of change, most notably containers, the ubiquitous use of JSON, HTTP/2, and microservices architectures. Unfortunately there was not much related activity around Java EE; but users of the many Java EE-compliant servers demanded adoption of those new technologies and paradigms.

=> ↺ ARM Preps ARMv8.4-A Support For GCC Compiler

• ARM Holdings has submitted patches implementing support for the ARMv8.4-A instruction set update for the GNU Compiler Collection (GCC).

• ARMv8.4-A adds a new Secure EL2 state, more cryptographic hashing algorithms are supported by the instruction set, support for Activity Monitors, improved virtualization support, and Memory Partitioning and Monitoring (MPAM) capabilities.

=> ↺ GitHub Issue Notifications on Open Source Projects

• Many Open Source Project maintainers suffer from a significant overdose of GitHub notifications. Many have turned them off completely for that.

• We (GitMate.io) are constantly researching about how people handle a flood of incoming issues in our aim to improve the situation by applying modern technologies to the problem. (Oh and we love free software!)

=> ↺ Computer Science Pioneer Bjarne Stroustrup to Receive the 2018 Charles Stark Draper Prize for Engineering

• C++’s combination of expressiveness and efficiency surpasses that of other programming languages, making it a popular choice for complex tasks with resource constraints such as game engines, database implementations, control systems, financial services, graphics, networking, and web servers. C++ is now used by approximately 4.5 million programmers around the world and has revolutionized numerous applications — from web services like Google and Facebook to medical systems such as CAT scanners and blood analyses.

=> ↺ Splice Hooking for Unix-Like Systems

• We actively use the Unix splice hooking approach described above in projects we create for our clients here at Apriorit, particularly in the area of cybersecurity. We’ve implemented this hook type for a variety of architectures and kernel versions, including x86_64, x86, and ARM in Linux 2.6.32 to 4.10.

• We hope that you find this approach useful and that you’ll be able to use some of the ideas presented in this article for your own hooking needs.

=> ↺ Inside the snake pit with ‘angr’ Python framework creator

• Well, angr is a highly modular Python framework that performs binary analysis using VEX as an intermediate representation. The name ‘angr’ is a pun on VEX, since when something is vexing, it makes you angry. It is made of many interlocking parts to provide useful abstractions for analysis. Under the hood, pretty much every primitive operation that angr does is a call into SimuVEX to execute some code.

• All IoT firmware is binary and only vendors have the source code. But often, IoT vendors don’t share source code, so security teams are left to find their own way to analyse the binary code. That means that, if you want to analyse IoT devices for vulnerabilities, then you need good binary analysis tools.

• Binary analysis goals: program verification; program testing; vulnerability excavation; vulnerability signature generation; reverse engineering; vulnerability excavation; exploit generation.

Leftovers

=> ↺ Get your SVGs out of your HTML

• How does a data url work? Normally a url in the background of a CSS element would say “go out and grab this asset at a different URL. A “data” url instead encodes all the data needed to render the image without making a new network request. Here’s an example of what one might look like:

Security

=> ↺ How Hackers Can Read Your Websites’ Passwords Using Meltdown And Spectre [With Solution]

• ​Everyone is talking about Meltdown and Spectre, the two security flaws found in Intel, AMD(less vulnerable) and ARM CPUs. Using the flaws attackers can read system memory which may have your passwords and other sensitive information. The worst part of it is that most systems are affected by it. So you’re most likely affected by these flaws. Let’s see how much an Internet surfer like you is affected by Meltdown.

=> ↺ Windows 10 Cumulative Update KB4056892 (Meltdown & Spectre Fix) Fails to Install

• Microsoft rolled out Windows 10 cumulative update KB4056892 yesterday as an emergency patch for systems running the Fall Creators Update in an attempt to fix the Meltdown and Spectre bugs affecting Intel, AMD, and ARM processors manufactured in the last two decades.

• But as it turns out, instead of fixing the two security vulnerabilities on some computers, the cumulative update actually breaks them down, with several users complaining that their systems were rendered useless after attempting to install KB4056892.

• Our readers pointed me to three different Microsoft Community threads (1, 2, 3) where users reported cumulative update KB4056892 issues, and in every case the problem appears to be exactly the same: AMD systems end up with a boot error before trying a rollback and failing with error 0x800f0845.

=> ↺ Linus Torvalds says Intel needs to admit it has issues with CPUs

• Linux creator Linus Torvalds has had some harsh words for Intel in the course of a discussion about patches for two [sic] bugs that were found to affect most of the company’s processors.

=> ↺ We translated Intel’s crap attempt to spin its way out of CPU security bug PR nightmare

• In the wake of The Register’s report on Tuesday about the vulnerabilities affecting Intel chips, Chipzilla on Wednesday issued a press release to address the problems disclosed by Google’s security researchers that afternoon.

• To help put Intel’s claims into context, we’ve annotated the text. Bold is Intel’s spin.

=> ↺ When F00F bug hit 20 years ago, Intel reacted the same way

• A little more than 20 years ago, Intel faced a problem with its processors, though it was not as big an issue as compared to the speculative execution bugs that were revealed this week.

=> ↺ Meltdown, Spectre and the Future of Secure Hardware

• Meltdown and Spectre are two different—but equally nasty—exploits in hardware. They are local, read-only exploits not known to corrupt, delete, nor modify data. For local single user laptops, such as Librem laptops, this is not as large of a threat as on shared servers—where a user on one virtual machine could access another user’s data on a separate virtual machine.

• As we have stated numerous times, security is a game of depth. To exploit any given layer, you go to a lower layer and you have access to everything higher in the stack.

=> ↺ KPTI — the new kernel feature to mitigate “meltdown”

=> ↺ Check This List to See If You’re Still Vulnerable to Meltdown and Spectre [Updated]

• Security researchers revealed disastrous flaws in processors manufactured by Intel and other companies this week. The vulnerabilities, which were discovered by Google’s Project Zero and nicknamed Meltdown and Spectre, can cause data to leak from kernel memory—which is really not ideal since the kernel is central to operating systems and handles a bunch of sensitive processes.

• Intel says that it’s working to update all of the processors it has introduced in the last few years. “By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years,” the company said in a statement today.

=> ↺ Meltdown and Spectre CPU Flaws Expose Modern Systems to Risk

• After a rollercoaster day of speculation on Jan. 3 about a severe Intel chip flaw, Google’s Project Zero research team revealed later that same day details about the CPU vulnerabilities.

• The CPU flaws have been branded as Meltdown and Spectre and have widespread impact across different silicon, operating system, browser and cloud vendors. The Meltdown flaw, identified as CVE-2017-5754, affects Intel CPUs. Spectre, known as CVE-2017-5753 and CVE-2017-5715, impacts all modern processors, including ones from Intel, Advanced Micro Devices and ARM.

=> ↺ Major Intel Kernel flaw may impact performance across Linux, Windows and Mac OS

• New reports have surfaced suggesting that there might be a major security flaw with Intel processors launched in the last decade. The harsh part is that patching the issue might slow down the performance of the CPU by up to 30 percent. Intel hasn’t put out an official statement yet, but Linux Kernel patches are being pushed out to all users.

=> ↺ Intel facing class-action lawsuits over Meltdown and Spectre bugs

• Intel has been hit with at least three class-action lawsuits over the major processor vulnerabilities revealed this week.

• The flaws, called Meltdown and Spectre, exist within virtually all modern processors and could allow hackers to steal sensitive data although no data breaches have been reported yet. While Spectre affects processors made by a variety of firms, Meltdown appears to primarily affect Intel processors made since 1995.

• Three separate class-action lawsuits have been filed by plaintiffs in California, Oregon and Indiana seeking compensation, with more expected. All three cite the security vulnerability and Intel’s delay in public disclosure from when it was first notified by researchers of the flaws in June. They also cite the alleged computer slowdown that will be caused by the fixes needed to address the security concerns, which Intel disputes is a major factor.

=> ↺ More about Spectre and the PowerPC (or why you may want to dust that G3 off)

• Most of the reports on the Spectre speculative execution exploit have concentrated on the two dominant architectures, x86 (in both its AMD and Meltdown-afflicted Intel forms) and ARM. In our last blog entry I said that PowerPC is vulnerable to the Spectre attack, and in broad strokes it is. However, I also still think that the attack is generally impractical on Power Macs due to the time needed to meaningfully exfiltrate information on machines that are now over a decade old, especially with JavaScript-based attacks even with the TenFourFox PowerPC JIT (to say nothing of various complicating microarchitectural details). But let’s say that those practical issues are irrelevant or handwaved away. Is PowerPC unusually vulnerable, or on the flip side unusually resistant, to Spectre-based attacks compared to x86 or ARM?

=> ↺ Measuring the Intel Management Engine to Create a More Secure Computer

• A modern computer has many different avenues for attack—ranging from local user-level exploits to root and kernel exploits, all the way down to exploits that compromise the boot loader or even the BIOS—but for over ten years the Intel Management Engine—with its full persistent access to all computer hardware combined with its secretive code base—has offered the theoretical worst-case scenario for a persistent invisible attack. The recent exploit from the talented group of researchers at Positive Technologies moves that worst-case scenario from “theoretical” to reality. While the proof-of-concept exploit is currently limited to local access, it is only a matter of time before that same style of stack smash attack turns remote by taking advantage of systems with AMT (Advanced Management Technology) enabled.

=> ↺ Linus Torvalds Latest Meltdown: “Is Intel Selling Sh*t And Never Willing To Fix Anything?”

• It’s not surprising to hear that the creator of the open-source Linux kernel couldn’t hold his temper after learning that Intel processors are affected by vulnerabilities that date back more than a decade ago. And why not? He has enough power to criticize Intel as the active development of the 26-year-old Linux kernel can’t go forward without him.

=> ↺ Linux Kernel 4.14.12 Released to Disable x86 PTI for AMD Radeon Processors

• It was bound to happen sooner or later, so Greg Kroah-Hartman just announced today the release of the Linux 4.14.12 kernel, which disables the x86 KPTI patches for AMD Radeon processors.

• Submitted over the Christmas holidays by AMD engineer Tom Lendacky, the “x86/cpu, x86/pti: Do not enable PTI on AMD processors” patch has landed today in the Linux 4.14.12 kernel, disabling the kernel page table isolation (KPTI) for all AMD Radeon processors, which were treated as “insecure” until now.

=> ↺ More Linux Kernel & GCC Patches Come Out In The Wake Of Spectre+Meltdown

• Besides the already-merged Kernel Page Table Isolation (KPTI) patches, other Linux kernel patches are coming out now in light of the recent Spectre and Meltdown vulnerabilities.

• Paul Turner of Google has posted some “request for comments” patches on a “Retpoline” implementation for the Linux kernel. The Retpoline patches are intended for fending off Spectre, the attack that breaks isolation between different applications. Unfortunately the Retpoline patching does add an additional cost to the kernel performance with the overall overhead being reported up to a 1.5% range.

=> ↺ KPTI Intel Chip Flaw Exposes Security Risks

• Operating system vendors are rushing to put out a fix for an alleged Intel chip flaw that could be used to exploit systems.

• Intel has not officially disclosed details on the flaw yet, though a patch already exists in the Linux kernel, with patches for Microsoft Windows and Apple macOS expected by Jan. 9. The Intel flaw doesn’t have a branded name at this point, though security researchers have referred to it as both KPTI (Kernel Page Table Isolation) and KAISER (Kernel Address Isolation to have Side-channels Efficiently Removed).

=> ↺ Reading privileged memory with a side-channel

• We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.

=> ↺ Security updates for Friday

=> ↺ ​How the Meltdown and Spectre security holes fixes will affect you

=> ↺ More details about mitigations for the CPU Speculative Execution issue

=> ↺ Purism Says It’s Releasing Patches to Stop Meltdown Attacks in Its Linux Laptops

• Purism’s response to the Meltdown and Spectre security exploits that put billions of devices at risk of attacks came today in the form of a press release with details on the patches for its PureOS operating system.

• If you own a Librem laptop from Purism, chances are it will get a patch to mitigate the Meltdown hardware exploit. The patch, as expected, consists of a kernel update, which users will have to install from PureOS’s software repositories and make sure they reboot their computers for the patch to be correctly installed.

• “Purism’s PureOS, a Free Software Foundation endorsed distribution, is releasing a patch to stop the Meltdown attack, with thanks to the quick and effective actions of the upstream Linux kernel development team,” says Todd Weaver, Founder and CEO of Purism in the press release.

=> ↺ PyCryptoMiner ropes Linux machines into Monero-mining botnet

• A Linux-based botnet that has been flying under the radar has earned its master at least 158 Monero (currently valued around $63,000).

=> ↺ Python-Based Botnet Targets Linux Systems with Exposed SSH Ports

• Experts believe that an experienced cybercrime group has created a botnet from compromised Linux-based systems and is using these servers and devices to mine Monero, a digital currency.

• Crooks are apparently using brute-force attacks against Linux systems that feature exposed SSH ports. If they guess the password, they use Python scripts to install a Monero miner.

=> ↺ AMD PSP Affected By Remote Code Execution Vulnerability

• While all eyes have been on Intel this week with the Spectre and Meltdown vulnerabilities, a disclosure was publicly made this week surrounding AMD’s PSP Secure Processor in an unrelated security bulletin.

• AMD’s Secure Processor / Platform Security Processor (PSP) that is akin to Intel’s Management Engine (ME) is reportedly vulnerable to remote code execution.

=> ↺ DragonFlyBSD Lands Fixes For Meltdown Vulnerability

• Linux, macOS, and Windows has taken most of the operating system attention when it comes down to the recently-disclosed Meltdown vulnerability but the BSDs too are prone to this CPU issue. DragonFlyBSD lead developer Matthew Dillon has landed his fixes for Meltdown.

=> ↺ Spectre question

• Could ASLR be used to prevent the Spectre attack?

• The way Spectre mitigations are shaping up, it’s going to require modification of every program that deals with sensitive data, inserting serialization instructions in the right places. Or programs can be compiled with all branch prediction disabled, with more of a speed hit.

• Either way, that’s going to be piecemeal and error-prone. We’ll be stuck with a new class of vulnerabilities for a long time. Perhaps good news for the security industry, but it’s going to become as tediously bad as buffer overflows for the rest of us.

• Also, so far the mitigations being developed for Spectre only cover branching, but the Spectre paper also suggests the attack can be used in the absence of branches to eg determine the contents of registers, as long as the attacker knows the address of suitable instructions to leverage.

=> ↺ Intel Deploying Updates for Spectre and Meltdown Exploits

• Intel reports that company has developed and is rapidly issuing updates for all types of Intel-based computer systems — including personal computers and servers — that render those systems immune from “Spectre” and “Meltdown” exploits reported by Google Project Zero. I

=> ↺ Capsule8 Launches Open Source Sensor for Real-time Attack Detection Capable of Detecting Meltdown

Transparency/Investigative Reporting

=> ↺ ‘US needs free press, but has media subservient to Clinton-Obama interests’

• There is a long-standing collusion between the mainstream media and the people in power loyal to the Clintons and the Obamas, who tried to put Hillary Clinton in power as president, investigative journalist Charles Ortel told RT.

• On December 30, WikiLeaks published an e-mail that, it said, showed how the New York Times was providing the State Department and Hillary Clinton with advanced warnings about potentially damaging stories.

Environment/Energy/Wildlife/Nature

=> ↺ National Bird Day

• Each year, over 45 million Americans take part in birdwatching, spending approximately $41 billion on related trips and equipment—contributing significantly to local communities and the national economy as a whole.

• While avian aficionados admire these special creatures year-round, birds are officially celebrated on National Bird Day—an opportunity to recognize the contributions they make to the health of ecosystems, the economy, and human enjoyment and creativity (just think of how many paintings, songs, and poems are inspired by birds!). January 5, 2018, will mark the 16th annual National Bird Day, and while it’s by no means the only opportunity to make friends of the feathered variety, it’s a good excuse to visit one of the country’s 29 National Estuarine Research Reserves, which are havens for birds and the people who love them.

Finance

=> ↺ Astounding coincidence: Intel’s CEO liquidated all the stock he was legally permitted to sell after learning of catastrophic processor flaws

=> ↺ Intel CEO sold all the stock he could after Intel learned of security bug

• While an Intel spokesperson told CBS Marketwatch reporter Jeremy Owens that the trades were “unrelated” to the security revelations, and Intel financial filings showed that the stock sales were previously scheduled, Krzanich scheduled those sales on October 30. That’s a full five months after researchers informed Intel of the vulnerabilities. And Intel has offered no further explanation of why Krzanich abruptly sold off all the stock he was permitted to.

=> ↺ Death of the American Trucker

• When Donald Trump sidles up to a semi truck, he’s usually selling policy only a plutocrat could love. Campaigning to repeal the Affordable Care Act in March, Trump pinned an iTrucks button to his lapel and honked the horn of a Mack truck outside the White House. “Obamacare,” he said, “has inflicted great pain on American truckers.” In October, at a rally before the “proud men and women of the American Trucking Associations” in Pennsylvania, Trump touted GOP plans to slash corporate taxes by 40 percent and to end “the crushing, horrible and unfair estate tax.” Behind him, positioned for the TV cameras, was an 18-wheeler – emblazoned with an unlikely slogan: truckers for tax reform. He vowed his America First agenda “means putting American truckers first.”

=> ↺ Ethereum Price Crosses $1,000 For The First Time To Create New Record

• It’s hard to point out the reason behind this recent rise in Ethereum price. However, as per experts (Via Fortune), this could be due to the push which was given by banking giants who have announced plans to test Ethereum blockchain.

=> ↺ Ethereum Rises Above $1,000 for the First Time as Ripple Soars

• Even as the arguable star of 2017 Bitcoin stalls thousands below its all-time high, the third largest cryptocurrency by market value, Ethereum, is soaring to new records Thursday.

• For the first time ever, Ethereum prices rose above $1,000 per unit in early trading Thursday, as investors look increasingly toward alternative currencies such as Ethereum, Ripple, and Litecoin.

=> ↺ Ripple Co-Founder Is Now Richer Than Google Co-Founders, Becomes One Of World’s Richest

• Larson holds a 5.19 billion XRP and a 17% stake in Ripple which made him take advantage of XRP’s recent rise. So, in total, he has control over 15.6 billion XRP. As of writing, Larson’s net worth is around $54.2 billion (XRP value $3.48, according to Coinmarketcap). Earlier, the value of XRP reaching $3.84 (net worth $59.9) made him reach just below Mark Zuckerberg who stands fourth on Forbes World’s Richest list.

=> ↺ 5 blockchain trends to watch for in 2018

• Few new technologies have raised as much discussion as blockchain. One reason is the controversy, concern, and perceived opportunity around blockchain-based cryptocurrencies such as bitcoin and ether. Another is the growing crop of ventures crowdfunded via initial coin offerings (ICOs).

=> ↺ City workers accused of tossing out homeless people’s belongings

• The City of Chicago is being accused of making a heartless attack on the homeless after a video showed crews clearing out a homeless camp along the Kennedy Expressway in the Avondale neighborhood.

• Jeffrey, a homeless Chicagoan, doesn’t have much, but the little that he and several other homeless men did have in the Belmont and Kedzie underpass was hauled off as trash by city cleanup crews Wednesday afternoon.

• A passersby saw what was happening and shot video.

=> ↺ Man ordered to stop housing homeless to keep them warm

• A Chicago man who has been helping homeless people get out of the cold by offering “slumber parties” at his home has been ordered to stop helping them.

• City officials are warning Greg Schiller to stop offering “slumber parties” in his basement to homeless people in his neighborhood or else his house will be condemned, NBC 5 reports.

=> ↺ Julio Lopez Varona on Puerto Rico’s Predators

• Meanwhile, the New York Times describes the banks and hedge funds that are preying on the situation—scooping up the homes of people unable to pay mortgage, for example—as “bargain hunters.” Different people have very different visions of the way forward for Puerto Rico—depending, to put it simply, on whether you think servicing debt matters more than human beings. It is, as a report from the activist group Hedge Clippers describes it, a story of “pain and profit”—and an important cautionary tale with meaning far beyond the island.

• Julio Lopez Varona works with Hedge Clippers; he’s also the founding organizer with Make the Road Connecticut. We’ll talk with Julio Lopez Varona about those seeking profit in Puerto Rico’s pain, and how we can change that story.

=> ↺ Revealed, how a THIRD of Tory donations come from a tiny group of rich men who enjoy lavish dinners with Theresa May

• More than a third of donations to the Tories last year came from a tiny group of super-rich men who enjoy lavish secretive dinners with Theresa May.

• Research reveals how much Britain’s party of government depends on a band of millionaires for survival.

• And it comes despite Mrs May vowing in 2007: “To restore public trust we must remove the dependency of the political parties on all large donors.”

• Labour analysed donations by the 64 people – 62 of them men – who attended ‘Leader’s Group’ dinners, hosted by the Prime Minister and other senior ministers, in the first half of last year.

=> ↺ Bitcoin Adoption Rate In Iran Surges Despite Censorship And Protests

• Massive protests erupted across Iran last Thursday, spurred by a stagnant economy and the rising cost of basic necessities. On Wednesday, almost a week later, the BBC reported 21 people were killed in subsequent protests. Iran’s Revolutionary Guards deployed forces to three provinces to quell the anti-government uproar. The government has blocked popular messaging services like Telegram and Signal, in addition to several internet networks. Yet despite censorship and civil unrest, the Iranian bitcoin community is growing rapidly.

=> ↺ Iranian Bitcoin Adoption Surges Amid Political Protests and Censorship

• Iran has witnessed widespread protests for the last week, with the media reporting that more than 20 individuals have been killed so far during the demonstrations. The protests have been attributed to popular dissatisfaction with high unemployment, inequality, housing costs, and other economic strains.

• The rebellion has seen the deployment of Iran’s Revolutionary Guard in three provinces, and censorship of numerous online networks – including Telegram and Signal. Despite the restricted access and rolling internet blackouts, Iran’s cryptocurrency community appears to be gaining strength during the turmoil.

AstroTurf/Lobbying/Politics

=> ↺ Is Facebook Enabling The African Exodus To Europe?

• Firstly, smugglers create accounts and pages on Facebook where they advertise their services and give their phone number, as well as recommend contacting them by WhatsApp application, which guarantees the encryption of messages.

• Secondly, in order to authenticate their message, they publish pictures showing preparations for the journey.

• Thirdly, they publish photos and reports of people who made it to European countries, which is supposed to build trust on the side of potential clients. Important information is also contained in comments under posts. Thanks to them you can find out, among others, who used the smugglers’ services. In this way, through the grapevine, the rumours are spread about planned relocation.

=> ↺ Donald Trump Didn’t Want to Be President

• On the afternoon of November 8, 2016, Kellyanne Conway settled into her glass office at Trump Tower. Right up until the last weeks of the race, the campaign headquarters had remained a listless place. All that seemed to distinguish it from a corporate back office were a few posters with right-wing slogans.

• Conway, the campaign’s manager, was in a remarkably buoyant mood, considering she was about to experience a resounding, if not cataclysmic, defeat. Donald Trump would lose the election — of this she was sure — but he would quite possibly hold the defeat to under six points. That was a substantial victory. As for the looming defeat itself, she shrugged it off: It was Reince Priebus’s fault, not hers.

=> ↺ The Wolff lines on Trump that ring unambiguously true

• There are definitely parts of Michael Wolff’s “Fire and Fury” that are wrong, sloppy, or betray off-the-record confidence. But there are two things he gets absolutely right, even in the eyes of White House officials who think some of the book’s scenes are fiction: his spot-on portrait of Trump as an emotionally erratic president, and the low opinion of him among some of those serving him. Why it matters: Wolff captures the contempt some Trump aides have for the president and his family. Axios’ Jonathan Swan notes that this includes people you see trumpeting their loyalty to him.

• So Wolff’s liberties with off-the-record comments — while ethically unacceptable to nearly all reporters — have the effect of exposing Washington’s insider jokes and secret languages, which normal Americans find perplexing and detestable.

=> ↺ ‘He’s totally onboard’: Wolff book describes Trump admin’s collusion with Israel

• Amid the media hype over Steve Bannon’s comments fueling allegations of collusion with Russia, pundits have overlooked an excerpt from the same book that points to collusion between the Trump administration and Israel.

• In the book, titled ‘Fire and Fury: Inside the Trump White House’, author Michael Wolff describes a conversation between former White House chief strategist Steve Bannon and Roger Ailes, the former CEO of Fox News who died in in May 2017.

=> ↺ Could It Be? Congress Actually Wants To Do The Right Thing On Electronic Voting!

• One of the topics we’ve talked about longer than any other topic on Techdirt is the problems with basically all electronic voting systems out there. Remember the good old days of Diebold, the well known voting machine maker? We wrote dozens of stories about its insecure machines starting back in 2003 and continued to write about the problems of electronic voting machines for years and years and years. We’ve gone through four Presidential elections since then and lots and lots of other elections — and while the security on e-voting machines has improved, it hasn’t improved that much and still is subject to all sorts of risks and questions. And those questions only serve to make people question the legitimacy of election results.

• And, for all those years, it appeared that basically no one in Congress seemed to have any interest in actually doing anything. Until now. A new bipartisan bill has been introduced, called the Secure Elections Act, that would actually target insecure e-voting machines.

=> ↺ Think Tank-Addicted Media Turn to Regime Change Enthusiasts for Iran Protest Commentary

• Since the outbreak of mass demonstrations and unrest in Iran last week, US media have mostly busied themselves with the question of not if we should “do something,” but what, exactly, that something should be. As usual, it’s simply taken for granted the United States has a divine right to intervene in the affairs of Iran, under the vague blanket of “human rights” and “democracy promotion.” (The rare exception, such as an op-ed by ex-Obama official Philip Gordon—New York Times, 12/30/17—still accepted the premise of regime change: “I, too, want to see the government in Tehran weakened, moderated or even removed.”) With this axiom firmly established in Very Serious foreign policy circles, the next question becomes the nature, degree and scope of the “something” being done.

=> ↺ Gazing at Iran Through a Distorted Glass

• A truism about U.S. politics and media is that once a foreign leader or a country has been demonized everything written or said about the subject will be skewed to the negative, a rule reflecting Washington’s groupthink and careerism, as ex-CIA analyst Paul R. Pillar notes about Iran.

=> ↺ Ohio’s Voter Purge Goes to the Supreme Court: What You Need to Know

• Ohio’s illegal purge practice has disenfranchised thousands already.

• In November 2015, Larry Harmon went to vote on a ballot initiative, only to find that his name was not on the list at his usual polling location.

• He had been purged. The reason? Larry had chosen not to vote in 2012, as he didn’t support either candidate and, he noted, “there isn’t a box on the ballot that says ‘none of the above.’” Larry also did not participate in the 2010 and 2014 midterm elections.

• The right to vote includes the right to decide whether, when, and how to exercise that right. Yet Ohio has adopted a “use it or lose it” policy that violated Larry’s right to choose when to vote, and has disenfranchised thousands of registered, eligible Ohioans.

=> ↺ Trump Disbands Sham Election Commission, but Wants Homeland Security to Continue Dirty Work of Voter Suppression

• Good riddance to the fraudulent commission, but we must remain vigilant against what replaces it.

• On Wednesday night, the White House announced that it would disband the Election “Integrity” Commission led by Vice President Pence and Kris Kobach, the Secretary of State of Kansas, citing the refusal of state officials to go along with Kobach’s reckless plan to collect sensitive data on every single voter in the country.

• Donald Trump formed the commission after he falsely claimed that he was the true winner of the national popular vote in the 2016 presidential election, claiming that his nearly 3 million vote deficit was the result of voter fraud. Despite failing to produce any proof of rampant voter fraud, the White House insisted in its statement last night that there is still “substantial evidence” of fraud. The president tweeted this morning that the “System is rigged, must go to Voter I.D.”

• The Trump administration also announced that the Department of Homeland Security will take up the voter fraud cause, and Kobach told Politico that “he expects officials from Immigration and Customs Enforcement and political appointees overseeing that agency to take over the commission’s work and begin efforts to match state voter rolls to federal databases of noncitizen.”

Censorship/Free Speech

=> ↺ Facebook declines to say why it deletes certain political accounts, but not others

• The fact Facebook has left accounts of other sanctioned individuals untouched suggests the social network may be subject to US government pressure behind the scenes. The company, which has a real name policy on its platform, could easily use screening software to ensure that it doesn’t do business with people or companies on OFAC’s sanctions lists.

=> ↺ Rights Groups Raise Alarm Over US Government Role in Facebook’s Selective Censorship

• Civil liberties and digital rights groups are raising concerns over the possible behind-the-scenes influence by the U.S. government in Facebook’s decision to selectively block some sanctioned world leaders from using the social media platform, while allowing others to maintain accounts.

• Facebook deleted the account of Chechen leader Ramzan Kadyrov last week, explaining that the head of the Russian republic had been added to the government’s sanctions list, which bars U.S. companies from providing services to him. Kadyrov has been accused of committing numerous human rights abuses against the LGBT community and his opponents.

=> ↺ This ex-NSA hacker is hunting white supremacists and hate groups lurking on Twitter

• Twitter and Facebook say hate speech is a violation of their policies but they also say it can be hard to identify who is engaged in bona fide hate speech and who isn’t.

• Twitter demonstrated the problem earlier this week when it came under fire for blocking a German satirical magazine’s Twitter account after it parodied anti-Muslim comments.

• Enter Emily Crose, a former NSA analyst, cybersecurity professional and former Reddit moderator.

=> ↺ German Hate Speech Law Backfires After Twitter Immediately Blocks Satire Account

• 2017 was the first year when public sentiment in the West began to shift against media, and large tech companies like Facebook and Google for allegedly enabling “fake news.” While decades of flawed economic policies have resulted in out of control wealth inequality, which has driven the public to populism and nationalism, somehow it is all the content distributors’ fault. But nowhere in the West has the backlash been bigger than Germany, thanks to a compounding refugee crisis that has made the situation worse.

=> ↺ Is Germany’s new hate speech law killing press freedom?

• Germany’s tough new social media law was meant to rid Twitter and Facebook of hateful and illegal content. But critics say that at just 96 hours old it is already choking press freedom.

=> ↺ Free speech vs. censorship in Germany

• Sophie Passmann is an unlikely poster child for Germany’s new online hate speech laws.

• The 24-year-old comedian from Cologne posted a satirical message on Twitter early on New Year’s Day, mocking the German far right’s fear that the hundreds of thousands of immigrants that have entered the country in recent years would endanger Germany’s culture. Instead of entertaining her more than 14,000 Twitter followers, Passmann’s tweet was blocked within nine hours by the American social media giant, telling users in Germany that Passmann’s message had run afoul of local laws.

=> ↺ China’s social media giants want their users to help out with the crushing burden of censorship

• China’s social media giants are ramping up efforts to get their users to turn in people circulating taboo content, as the Communist Party further tightens its grip on the country’s internet.

• On Monday (Jan. 1), China’s tech giant Tencent said it was hiring (link in Chinese) 200 content reviewers to form what the company is calling a “penguin patrol unit,” after the company’s penguin mascot. The brigade, made of 10 journalists, 70 writers who use Tencent’s content platforms, and 120 regular internet users, will flag “low-quality” content.

=> ↺ Really Bad Ideas: French President Macron Wants To Ban ‘Fake News’ During The Election

• The transparency idea isn’t such a bad one (though the details would matter quite a bit), but it’s unclear why the amount of money for sponsored content should be capped if it’s clearly labeled and disclosed. But the really troubling part is that last one, allowing for “emergency legal action” to remove content. It may not be surprising that Macron is saying this about fake news — since there were reports of a burst of fake new campaigns that tried to influence the French electorate to vote against Macron in the election.

• But, as we’ve discussed many, many times — the idea of government-mandated censorship, even if for the idea of stopping “fake news” is a terrible idea. It will be abused and abused badly. Remember, while the term “fake news” was first popularized by people who were upset about Donald Trump’s election, he’s now co-opted the term and uses it to argue that any media report that makes him look bad is “fake news.” Imagine what a Trump or a French Trump-like figure would do with this kind of power?

=> ↺ Iran Internet Censorship Forces Protesters to Turn to Dark Web

• Internet censorship in Iran has caused thousands of Iranians to turn to specialist software to bypass the restrictions, as anti-government protests continue across the country.

=> ↺ Iran’s social media blackout forces apps to submit or face a total ban

=> ↺ Netizen Report: Iranian Authorities Blocking International Web Traffic, Messaging Platforms

=> ↺ How Iranian protesters are skirting the government’s tech clampdown to continue their fight

=> ↺ Censorship stupidity: Trump tries to keep the Wolff from his door

• How fitting it is that Trump’s tinpot totalitarian attempt to block the release of a devastating book roughly parallels Richard Nixon’s attempt to block the release of the Pentagon Papers. Two malignantly unhinged presidents, two frontal assaults on the pillars of the First Amendment.

• Purely by chance yesterday, I was watching Steven Spielberg’s “The Post” while the details of Trump’s desperate bid flooded the news cycle. Inside the theater, a Nixon lawyer was telling the newspaper, “I respectfully request that you publish nothing further of this nature.” Outside the theater, a Trump lawyer was telling the publisher of Michael Wolff’s “Fire and Fury” much the same thing: “Mr. Trump hereby demands that you immediately cease & desist from any further publication, release, or dissemination of the Book.”

=> ↺ Speaking as a parent, YouTube’s censorship system is deeply flawed

• Anyone who knows me will tell you that I’m very dedicated to being a “good mom.” For me, this means being emotionally and physically available for my kids, giving them everything they need and some of what they want, and taking an active interest in what appeals to them.

• [...]

• What I found was shocking and upsetting.

• Some videos mimicked the one I’d already seen, but others were much worse. In some, the girls were wearing swimsuits in a bathtub while the same man from before— their father— scared them with frogs and lizards until they cried. Other videos showed them dressed as babies, and involved acts of force-feeding, intentional spitting up, and going to the bathroom in diapers. I was livid that these girls were being filmed and exploited, and after coverage on BuzzFeed News, the account was shut down, the father is being investigated, and hundreds of thousands of other disturbing YouTube videos starring children have been deleted.

=> ↺ China’s media watchdog in legal challenge over censorship of gay content

• A member of the public is taking China’s media watchdog to court over new regulations that describe gay relationships as “abnormal”, demanding the regulator provide a legal basis for censoring audiovisual content on the internet that depicts homosexuality.

• In a rare move, the Beijing No 1 Intermediate People’s Court accepted the case from Fan Chunlin, 30, earlier this week and is expected to hand down a verdict within six months, state-run Global Times reported, citing Fan’s lawyer, Tang Xiangqian.

Privacy/Surveillance

=> ↺ State Child Care Laws Should Not Require Teenage Kids to Submit Biometric Data to the FBI

• Jennifer Parrish, a child care provider in Minnesota who runs a day care out of her home, finds herself at a crossroads due to a recently passed Minnesota law. The law imposes new background check requirements on child care providers, including that they provide biometric information. But the law doesn’t apply just to the providers themselves; it also requires anyone age 13 and up who lives with a family day care provider to submit to the same background check, whether or not they have committed any crime. This means Jennifer’s 14-year-old son, along with about 12,000 other kids in Minnesota, must provide his fingerprints and a face recognition photograph to the state, which will send them to the FBI to be stored for his lifetime in the FBI’s vast biometrics database.

=> ↺ NSA chief Mike Rogers expected to retire from agency in spring

=> ↺ NSA’s Rogers to retire this spring

=> ↺ NSA Chief Mike Rogers’s Classified Retirement Memo Leaks

=> ↺ NSA director to leave agency in the spring: Report

=> ↺ NSA chief to leave, expects successor this month: Report

=> ↺ NSA director Mike Rogers announces his retirement

=> ↺ Agency Transformed, NSA Chief Rogers Set for Spring Departure

=> ↺ A former hacktivist reveals how a UK spy agency is actively subverting democracy [VIDEO]

• A co-founder of the hacker activist group LulzSec warns how a UK Government cyber warfare unit has been actively engaged in subverting democracy and creating fake news for the last decade. Leaked documents back this up.

• And these revelations highlight the hypocrisy of the statement by British Prime Minister Theresa May, reiterated by Foreign Secretary Boris Johnson, accusing Russia of election meddling.

• Fake accounts

• A presentation [0:15] on 27 December by LulzSec co-founder and security researcher Mustafa Al-Bassam to the Chaos Communication Congress summarises the work of the secretive Joint Threat Research Intelligence Group (JTRIG).

=> ↺ Amazon turns over record amount of customer data to US law enforcement

• Amazon has turned over a record amount of customer data to the US government in the first-half of last year in response to demands by law enforcement.

• The retail and cloud giant quietly posted its latest transparency report on Dec. 29 without notice — as it has with previous reports — detailing the latest figures for the first six months of 2017.

• The report, which focuses solely on its Amazon Web Services cloud business, revealed 1,936 different requests between January and June 2017, a rise from the previous bi-annual report.

=> ↺ California Senate to Hear EFF’s License Plate Cover Bill

• Across the country, private companies are deploying vehicles mounted with automated license plate readers (ALPRs) to drive up and down streets to document the travel patterns of everyday drivers. These systems take photos of every license plate they see, tag them with time and location, and upload them to a central database. These companies—who are essentially data brokers that scrape information from our vehicles—sell this information to lenders, insurance companies, and debt collectors. They also sell this information to law enforcement, including U.S. Department of Homeland security, which recently released its updated policy for leveraging commercial ALPR data for immigration enforcement.

=> ↺ Q&A: Edward Snowden on rights, privacy, secrets and leaks in conversation with Jimmy Wales

• I don’t pass judgment on whether Wikileaks did the right thing or the wrong thing, because I think this kind of experimentation is important. We need to challenge the orthodoxy.

• We need to challenge the presumptions that whatever we’re doing right now, the status quo, is the best of all possible worlds. This is the best anybody could possibly do. Instead, we test our premises again and again in different ways, so what I did was I saw that inside the United States government, the National Security Agency had started violating the Constitution in a very unprecedented and indiscriminate way.

=> ↺ Police Scotland to use drones that see in dark for spy missions

• INTELLIGENT drones that can see in the dark will be used for secret police spy missions, Police Scotland has said.

• Drones equipped with “intelligent computer systems and thermal imaging” are being developed by Scottish universities for use by the force.

• Plans are already under way to purchase two relatively low-tech off the shelf drones for Aberdeen and Inverness, primarily for use in missing persons searches.

=> ↺ DHS Expands License Plate Dragnet, Streams Collections To US Law Enforcement Agencies

• The DHS has provided the public with a Privacy Impact Assessment (PIA) on its use of license plate readers (LPRs). What the document shows is the DHS’s hasty abandonment of plans for a national license plate database had little impact on its ability to create a replacement national license plate database. The document deals with border areas primarily, but that shouldn’t lead inland drivers to believe they won’t be swept up in the collection.

=> ↺ China Plans To Turn Country’s Most Popular App, WeChat, Into An Official ID System

• In one respect at least, China’s embrace of digital technology is far deeper and arguably more advanced than that of the West. Mobile phones are not only ubiquitous, but they are routinely used for just about every kind of daily transaction, especially for those involving digital payments. At the heart of that ecosystem sits Tencent’s WeChat program, which has around a billion users in China. It has evolved from a simple chat application to a complete platform running hugely popular apps that are now an essential part of everyday life for most Chinese citizens.

=> ↺ Former NSA worker pleads guilty to biggest theft of data

• Martin has been accused of stealing a massive 50TB of classified data from the NSA over the course of the 20 years that he was working there as a contractor. The government has not said what was done with the stolen data, but it is believed that the data stolen included elite hacking tools that Martin stole while working for Booz Allen Hamilton Holding Corp, the very same firm that employed the whistle blower Edward Snowden.

=> ↺ Personal data of a billion Indians sold online for £6, report claims

• The reported breach is the latest in a series of alleged leaks from the Aadhaar database, which has been collecting the photographs, thumbprints, retina scans and other identifying details of every Indian citizen.

=> ↺ 36 fake security apps harvesting user data and tracking their location found in Google Play Store

• Security researchers have unearthed 36 malicious Android apps parading as security tools on the Google Play Store that actually harvest user data, track their location and more. According to Trend Micro, these apps offered users a wide range of security capabilities including cleaning junk, saving battery, scanning, CPU cooling, locking apps, Wi-Fi security, message security and more.

=> ↺ Yes, Your Amazon Echo Is an Ad Machine

=> ↺ Amazon has big plans for Alexa ads in 2018; it’s discussing options with P&G, Clorox and others

• The e-tailer has been in talks with several companies about letting them promote products on the best-selling Echo devices, which are powered by the Alexa voice assistant, according to several people familiar with the matter who asked not to be named because the discussions are private. Consumer companies, including Procter & Gamble and Clorox, have been involved in these talks, according to the people.

Civil Rights/Policing

=> ↺ The Espionage Act And NSA Whistleblower Reality Winner’s Uphill Battle

• The defense for Reality Winner, a National Security Agency contractor accused of mailing a classified document on Russian hacking to The Intercept, contends the government misstates the law under the Espionage Act. They believe the government ignores “serious constitutional problems” raised by their interpretation of the statute.

• But Winner’s defense faces a tremendous uphill struggle. Under President Barack Obama’s administration, leak prosecutions intensified the government’s ability to wield the Espionage Act as a strict liability offense, which means there is very little the government has to prove beyond the fact that an unauthorized disclosure took place.

• Winner is scheduled to go on trial on March 19, in Augusta, Georgia. Since her arrest in June, she has been held in pretrial detention, with Judge Brian Epps refusing to grant her bail.

• Epps suggested Winner’s “hate” for America and supposed admiration for NSA whistleblower Edward Snowden and WikiLeaks editor-in-chief Julian Assange makes her an ongoing threat to “national security.”

=> ↺ An Indiana State Rep’s Indecent Proposal to Get Colts Players to Stop Taking a Knee

• On Sept. 24, Milo Smith took his daughter to an Indianapolis Colts’ game against the Cleveland Browns. Though the Colts won that day — a tragically rare occurrence this year — Smith left the game offended. During the national anthem, a group of players on both teams took a knee in reaction to President Trump’s comments two days earlier, where he called protesting players sons of bitches who should be fired by team ownership.

• “To me when they take a knee during the national anthem, it’s not respecting the national anthem or our country,” Smith told the Indianapolis Star newspaper. “Our government isn’t perfect, but it’s still the best country in the world and I think we need to be respectful of it.”

• But Smith isn’t just an ordinary Colts’ fan. He’s a state representative, and he couldn’t sit idly by while the Colts players knelt during the Star-Spangled Banner. Instead, he’s promised to introduce legislation that would force the team to refund the ticket price to any fan offended by a Colts player protesting during the national anthem.

• If passed, however, that law would be an unconstitutional violation of the First Amendment.

=> ↺ Indiana Legislator Wants To Force NFL Team To Hand Out Refunds To Fans ‘Offended’ By Kneeling Players

• Kneeling doesn’t “disrespect” paying customers. If they want to feel offended by it, that’s their prerogative, but it’s not directed towards them. And it has nothing to do with not respecting the national anthem, the United States, the troops fighting for these players’ freedom to express themselves, or anything else related to patriotic jingoism. It’s a protest of ongoing oppression of African Americans in the United States. That’s what has been diluted by attacks on this particular form of protest. Not only have people like Smith managed to turn the protest into an anti-American statement, they’ve shifted the players’ goalposts away from the law enforcement target to an assault the flag, the troops, and every other symbol of unquestioning patriotism.

• Smith is dumb and his proposed law is dumber. Even if it manages to survive a vote on its highly-dubious merits, it certainly won’t survive a Constitutional challenge. As Howard Wasserman of Prawfsblog points out, there are numerous ways the law could be construed as government infringement on free speech rights.

=> ↺ For Cops Handing Out Bogus Pedestrian Tickets, Ignorance Of The Law Is The Most Profitable Excuse

• The official reaction to ProPublica’s report has been worse than a shrug. It’s been genuine indifference to the problems it causes people ticketed for non-violations of the law. Most law enforcement agencies said nothing more than recipients were welcome to challenge the bogus tickets in court. But people always could, so it’s not like the agencies are making some sort of concession, much less offering apologies or promises to improve. The “fight it in court” proposal is a non-starter, since it’s likely wages lost due to a day in court will far outweigh the face value of the ticket they never should have received. The potential savings of $55-77 just isn’t worth it for most people, so the government will continue to collect on bogus tickets simply because it’s hit a sweet spot in pricing.

• Then there’s the reaction of this agency, which openly admits pedestrian stops aren’t about pedestrian safety or even actual violations of the law.

Internet Policy/Net Neutrality

=> ↺ Supporters Aim To Use Net Neutrality To Bludgeon Cash-Compromised Lawmakers In The Midterms

• We’ve already noted that the best route for killing the FCC’s recent attack on net neutrality rests with the courts. Once the repeal hits the Federal Register in January or soon thereafter, competitors and consumer groups will be filing multiple lawsuits against the FCC. Those lawsuits will quite correctly note how the FCC ignored the public, relied on debunked lobbyist data, ignored the people who built the internet, and turned a blind eye to rampant fraud during the comment proceeding as it tried to rush through what may just be the least popular tech policy decision in a generation.

• The hope will be to highlight that the FCC engaged in “arbitrary and capricious behavior” under the Telecommunications Act by reversing such a popular rule — without proving that the broadband market had dramatically changed in just the last two years. They’ll also try to claim that the FCC violated the Administrative Procedure Act, and even went so far as to block law enforcement investigations into numerous instances of comment fraud during the open comment period.

=> ↺ Maine Governor Tells 16-Year-Old Worried About Net Neutrality Repeal To ‘Pick Up A Book And Read’

• As more than a few folks have noted, many opponents of net neutrality (from FCC boss Ajit Pai to Mark Cuban) are following blind ideology. Many of them quite honestly believe that no regulation can ever be good, and that government is absolutely never capable of doing the right thing. That kind of simplicity may feel good as you navigate a complicated world, but it’s intellectually lazy. As a result, the decision to use net neutrality rules as an imperfect but necessary stopgap (until we can reduce corruption and drive more competition into the sector) simply befuddles them.

• Of course this kind of blind ideology is particularly handy when you don’t actually know how modern broadband markets or net neutrality even work, but your gut just tells you why the whole nefarious affair is simply bad. That’s why you’ll see folks like Ted Cruz consistently doubling down on bizarre, misleading claims based on repeatedly debunked falsehoods. Needless to say, this sort of lazy thinking is not particularly productive. Especially when you’re a member of the same government purportedly tasked with analyzing real-world data, listening to constituent concerns, and actively tasked with making things better.

=> ↺ California The Latest State To Propose Its Own Net Neutrality Rules

=> ↺ California Introduces Its Own Bill to Protect Net Neutrality

• 2018 has barely begun, and so has the fight to preserve net neutrality. January 3 was the first day of business in the California state legislature, and state Sen. Scott Wiener used it to introduce legislation to protect net neutrality for Californians.

• As the FCC has sought to abandon its role as the protector of a free and open Internet at the federal level, states are seeking ways to step into the void. Prior to December, the FCC’s rules prevented Internet service providers (ISPs) from blocking or slowing down traffic to websites. The rules also kept ISPs from charging users higher rates for faster access to certain websites or charging websites to be automatically included in any sort of “fast lane.” On December 14th, the FCC voted to remove these restrictions and even tried to make it harder for anyone else to regulate ISPs in a similar way.

=> ↺ FCC releases final net neutrality repeal order, three weeks after vote

• In 2015, a month passed between the net neutrality order being made public and its appearance in the Federal Register. That means the current net neutrality rules could technically remain on the books until April 2018, although the FCC leadership won’t be going out of its way to enforce them in the meantime.

=> ↺ “Vote out” congresspeople who won’t back net neutrality, advocates say

• The website lists which senators have and haven’t supported a plan to use the Congressional Review Act (CRA) to stop the repeal of net neutrality rules. The rules, repealed by the Federal Communications Commission last month, prohibit Internet service providers from blocking or throttling Internet content or prioritizing content in exchange for payment.

Intellectual Monopolies

Trademarks

=> ↺ It Begins: Some Comic Conventions Refusing To Fold After San Diego Comic-Con Gets Its Trademark Win

• After following the saga of what seemed like a truly misguided lawsuit brought by the San Diego Comic-Con against the company putting on the Salt Lake ComiCon, the whole thing culminated in the SDCC getting a win in the courtroom. One of the reasons this verdict threw many, including this writer, for a loop is that the defendant in the case made the argument that the SDCC had allowed the term “comic con” to become generic, an argument buttressed by the reality of there being roughly a zillion comic conventions using the term across America. Despite the SLCC’s public discussions about appealing the decision and the fact that proceedings are already underway to cancel the SDCC’s trademark entirely, much of the media speculation centered around what those zillion other conventions would do in reaction to the verdict.

Copyrights

=> ↺ Corel Patents System to Monetize Software Piracy

• Canadian software company Corel, known for iconic products such as CorelDRAW and Winzip, has a new anti-piracy patent. Instead of implementing tougher restrictions, the company proposes to reach out to pirates through a messaging system, offering ‘amnesty’ to those who are willing to pay up.

=> ↺ White Noise On YouTube Gets FIVE Separate Copyright Claims From Other White Noise Providers

• The implications of YouTube’s ContentID system in an era of user-generated content can sometimes be quite muddy. It is widely known that ContentID is open to abuse, and that it is indeed abused on the regular. However, too many stories about that abuse play far in the margins of what the average person could look at and recognize as a very real problem.

• This is not one of those stories.

• Instead, the story of how one music professor’s upload to YouTube of 10 hours of pure white noise was flagged five times for copyright infringement (FIVE TIMES!) operates as though someone somewhere is trying to bring a reductio ad absurdum argument into physicality.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

=> Techrights

➮ Sharing is caring. Content is available under CC-BY-SA.