This page permanently redirects to gemini://gemini.techrights.org/2022/10/23/devhelp/.

● 10.23.22

Gemini version available ♊︎

● Links 23/10/2022: Devhelp and Microsoft Confirming It Got Cracked Again

Posted in News Roundup at 9:21 am by Dr. Roy Schestowitz

GNU/Linux

Audiocasts/Shows

=> ↺ Installation and First Look of Ubuntu 22.10 – Invidious

• In this video, I’m going to do an installation and first look of the recently released Ubuntu 22.10, codenamed “Kinetic Kudu”. What’s new in this release? And is it worth it to upgrade if you are running 22.04?

=> ↺ E89: Tech Talk: Secure Your Linux Server – Invidious

=> ↺ GNU World Order 483

• kmime , kmines , kmix , kmousetool , kmouth from the KDE software series of Slackware.

Instructionals/Technical

=> ↺ Day 20: the scrollbar-gutter property

• It’s time to get me up to speed with modern CSS. There’s so much new in CSS that I know too little about. To change that I’ve started #100DaysOfMoreOrLessModernCSS. Why more or less modern CSS? Because some topics will be about cutting-edge features, while other stuff has been around for quite a while already, but I just have little to no experience with it.

=> ↺ Dogfooding Vanilla CSS

• The last changes I made to my classless CSS framework, Vanilla CSS, was in November of 2021. It feels like I just pushed out that small project last weekend, yet here we are almost a full year later.

• So I decided to circle-back on the project to see if there were any improvements I should make or features that could add. Overall, I was impressed that I covered most web UI elements fairly well on the initial release. Good job, past Brad.

=> ↺ How To Install Mastodon on Ubuntu 22.04 LTS – idroot

• In this tutorial, we will show you how to install Mastodon on Ubuntu 22.04 LTS. For those of you who didn’t know, Mastodon is an open-source decentralized social network. It offers microblogging features that allow you to follow other users and post messages and images with Mastodon. Its is written in Ruby and JavaScript and its open-source nature makes sure that it remains open for anyone to use privately and securely. Anyone can create a Mastodon server and build their own communities with friends. Additionally, Mastodon is supported by and available through multiple apps for iOS, Android, and other platforms

• This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Mastodon social networking on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

=> ↺ How to Install LibreOffice on Ubuntu – Linux Nightly

• LibreOffice is a suite of applications for creating documents, spreadsheets, presentations, and other things. It can be easily installed on Ubuntu from the official repositories, either as the entire suite or just individual apps. In this tutorial, you will learn how to install LibreOffice on Ubuntu Linux via command line and GUI.

=> ↺ Send warning email when your drive is dying – Lukáš Zapletal

• My Samsung 870 EVO 2TB SDD is dying after 13 months of basic workstation operation. Looks like some problem with a large batch because I found many other users complaining on forums. I am going for RMA. Fortunately, I restored from my backup.

• Lesson learned: SMART needs to be monitored on my home servers, this is not the first time and I was lucky enough to see the errors in the system journal in advance.

• How to do that? There are multiple options, there is a shell script which ships with the smartmontools package, but I could not get it working.

=> ↺ How to Install DEB File in Ubuntu and Debian – Linux Nightly

• A DEB file is a Debian software package and it can be used to install an application or system program. All Linux distributions based on Debian can install software from a DEB file. This includes distributions like Ubuntu and Linux Mint.

• In this tutorial, you will learn several ways to install a .deb file on Debian, Ubuntu, Linux Mint, and other Debian-based distros.

=> ↺ How To Install Software in Ubuntu Linux: A Complete Guide for Newbie

• Ten years ago, when I was new to the world of Ubuntu Linux, I was so confused about many things about how to do this and that. Among all those, how to install the software in Ubuntu Linux is one of them. As a beginner, you also face this sort of problem, especially when many more options are available for installing and removing software in Ubuntu Linux.

• In this roundup, I will show you some of the popular ways to install the software in Ubuntu Linux. I will also try to cover how to remove the Ubuntu application from the system.

=> ↺ How to get started with MariaDB commands for DB administration Git lib ted tmp – LinuxTechLab

• In this Beginner’s friendly tutorial, we are going to discuss some MariaDB administration commands.

=> ↺ Linux Terminal Server | Linux.org

• A Terminal Server is a server that can provide the Operating System to the workstations. In most cases, the workstations are diskless and have no means to install an Operating System (OS).

• Basically, on the Linux Terminal Server, there are images created that are used by the client systems. You can create an image with all installed applications, wallpaper, etc. Each system will then use this image as if it were a live-CD image. The image is read-only and you must update the image when you need another program or an Operating System update.

Games

=> ↺ Valve starts roll-out of the Steam Deck controller configurator to desktop Steam

• The latest Steam Client Beta replaces the old Big Picture Configurator for individual games, with the one from the Steam Deck and it’s quite an improvement.

=> ↺ Valve put up a few more fixes in the new Steam Deck Beta

• Another Beta update is available for the Steam Deck, with Valve adding in just a few more “Friday fixes”. It’s available in the Beta and Preview channels. You can opt into this in: Settings >System >Steam Update Channel.

Desktop Environments/WMs

GNOME Desktop/GTK

=> ↺ Devhelp

• Tobias Bernard has recently published this article on the Planet GNOME and mentions Devhelp. Since I did a fair amount of development contributions to Devhelp more or less recently (compared to the whole GNOME history), I would like to talk a bit more about it.

• Devhelp has always been a Local-First app, not requiring an internet connection to work. It hasn’t been created by me, it existed long before I started developing with GTK, so the original authors and past contributors need to be thanked. The first commits were done by Johan Dahlin in 2001. In comparison my first commit to Devhelp was in 2015.

Distributions and Operating Systems

BSD

=> ↺ My FreeBSD Friday Lecture: The Writing Scholar’s Guide to FreeBSD

• I wrote much of the script for this lecture by merging my January/February 2021 FreeBSD Journal article “FreeBSD for the Writing Scholar” with my FOSDEM 2021 talk “FOSS for the Professional Historian.”

• In keeping with my stated wishes, the words that I spoke during my FreeBSD Friday lecture are available under the Creative Commons Attribution 4.0 International License (CC BY). Thus, anyone is free to share and/or adapt them for any purpose, as long as I receive appropriate credit. The video recording itself belongs to the FreeBSD Foundation.

• Here I share both the video recording of the presentation as it is housed permanently on Youtube and my original script. I deviated (often significantly) from the prepared script during the actual lecture. Since most of my deviations were expansions on already present themes, however, everything that matters remains present in the text. I have added several hyperlinks to assist the reader who is eager to learn more about the many software projects that I discuss.

=> ↺ Raspberry Pi 4 with FreeBSD 13-RELEASE: A Perfect Miniature Homelab

• I have used the Pi 4 with FreeBSD 13-RELEASE for a range of tasks. Most commonly, I use it for Mumble voice communication (as a Murmur server) and for 24/7 continuous access to my favorite IRC channels on Libera.chat (including #freebsd, #freebsd-desktop, and #freebsd-wiki) by way of a Weechat session in tmux.

Canonical/Ubuntu Family

=> ↺ Ubuntu 22.10 released – OSnews

• While I’m personally not really using Ubuntu itself anymore, my gaming PC is still running Linux Mint, meaning I will still benefit from this new release. Ubuntu is still massively popular despite stumbles over the years, and countless popular distributions are all based on it.

Devices/Embedded

=> ↺ Is Your Car Autonomous? The 6 Levels of Self-Driving Explained

• Autonomous cars are sharing the road with drivers in select cities, but what counts as self-driving? In the US, the National Highway Traffic Safety Administration (NHTSA) has recognized standards developed by SAE International since 2016(Opens in a new window), which outline six levels(Opens in a new window) of driving automation. These levels identify how autonomous a vehicle can be; does the car need a human behind the wheel or can it navigate the streets solo, for example? Here’s what each level means.

=> ↺ Here’s When We’ll See Driverless Cars With Level 5 Autonomy

• Well, to figure out the best course of action, let’s take a closer look at level 5 autonomy and, ultimately, when it may arrive.

=> ↺ SoM board features Allwinner H616 processor

• BIGTREETECH has unveiled a compact board equipped with a 64-bit Allwinner H616 processor. Additionally, the company is offering a compatible PI4B adapter which gives access to one LAN port, dual Micro HDMI ports, one USB Type-C and other standard peripherals.

=> ↺ Building A Local Network With LoRaWAN

• At its core, the Internet is really just a bunch of computers networked together. There’s no reason that there can’t be other separate networks of computers, or that we all have to tie every computer we have to The One Internet To Rule Them All. In fact, for a lot of embedded systems, it doesn’t make much sense to give them a full network stack and Cat6e Ethernet just to report a few details about themselves. Enter LoRaWAN, a wireless LAN that uses extremely low power for Internet-of-Things devices, and an implementation of one of these networks in an urban environment.

=> ↺ The Commodordion Turns Two C64s Into A Single Instrument

• One of the main reasons the Commodore 64 became an icon of the 1980s was its MOS 6581 “SID” sound chip that gave it audio capabilities well beyond those of other microcomputers of the 8-bit era. The SID became something of a legend by itself among chiptune enthusiasts, and several electronic instruments have been designed that generate their sound through a SID chip. Not many of those look anything like traditional musical instruments however, so we’re delighted to see [Linus Åkesson]’s new project: two Commodore 64s joined back-to-back using a bellows to form a wonderful new instrument called the Commodordion. It can be played in a similar way one plays a traditional accordion: melodies are played with the right hand, chords with the left, and volume is adjusted by varying the pressure in the bellows.

Open Hardware/Modding

=> ↺ An easier way to find an ASUSTOR NAS to set it up

• I have a few ASUSTOR NASes at my house, and I don’t like installing a custom application just to identify the NAS so I can visit it’s web UI the first time.

• The official ASUSTOR getting started guide recommends installing ASUSTOR Control Center, which does a good job of identifying ASUSTOR devices on your network. And that’s about it.

• But behind the scenes, it’s likely just scanning your network and matching any MAC addresses in Asustek’s range. Which is easy to do without a third party app.

=> ↺ Refurb weekend: PowerBook 1400

• The original motherboard eventually got flaky, so I transferred everything over to a 1400c/166 motherboard which also gave me an extra 4MB of RAM headroom and a lovely active matrix display. Even after I got the iBook G4 I still used it as a classic Mac portable, and upgraded the G3 to 466MHz (the last and greatest of the Sonnet 1400 upgrades) and installed a replacement 2.5″ IDE hard disk with more space. I’ve even got a metric butt-ton of batteries that still vaguely hold a charge along with a VST dual battery charger to charge ‘em. Short of putting an SSD or CF drive in it, I challenge you to find a 1400 that’s more pimped out than this one. Nowadays its most important tasks are running classic Mac OS 9 software with a smaller footprint than my TiBook G4, as well as serving as a serial console using ZTerm and a Mac printer cable.

=> ↺ Police: Drone threat is “here to stay”

• “However, as a matter of principle, we do not shoot down drones, and the police do not recommend it to anyone else either,” Hätönen said.

=> ↺ A Raspberry Pi Pico conducts this lo-fi orchestra

• This lo-fi orchestra found modest fame on Twitter playing an 8-bit synthesised rendition of Mike Oldfield’s Tubular Bells. It was created by Kevin (aka @diyelectromusic). We are trained to ignite when we see a herd of boards and wires, so we dove a little deeper and saw that Raspberry Pi had indeed weaselled its way into the band.

=> ↺ AuraLock automatic door opener

• The pair also faced problems when implementing OpenCV to recognise faces. “The library is vast and difficult to install easily,” Dillon says. “Once OpenCV was installed, I realised it was not designed to accept new face encodings dynamically – all registered images were generally hard-coded on bootup.”

• To overcome this, Dillon implemented a dynamically updating dictionary, and he refreshed the OpenCV code to reflect the changes. The pair also used a Google Firebase database that allowed for communication between Raspberry Pi and the Android app. “Having to communicate with other devices through Firebase added a level of difficulty that wasn’t anticipated at first,” Erin says.

=> ↺ Innodisk releases USB camera modules for AI applications – CNX Software

• Innodisk, better known for its industrial storage solutions and embedded peripherals, has recently announced a shift towards the AI industry, and the first products for this market are three USB 2.0 camera modules with 1920×1080 resolution.

=> ↺ ine64 Announces ‘Sub-$10, Linux-Capable’ SBC – the Ox64

Free, Libre, and Open Source Software

Web Browsers/Web Servers

=> ↺ The programming challenge that is a modern browser

• Browsers cover so much ground and are so large that they effectively contain multiple substantial projects as subsystems. You have a Javascript execution system (and now a WebAssembly one too), HTML and CSS parsing, web page DOM rendering (including complex text rendering in a wide variety of languages and fonts), a complex TLS system, a networking system that handles multiple protocols, an asynchronous DNS resolver, image, audio, and video format decoders and players, database and cache layers, and so on. All of these subsystems are complicated by security concerns and many of them interconnect with each other at various levels. Some browsers also have to be cross-platform on top of this.

SaaS/Back End/Databases

=> ↺ Building a Queue for Delayed Messages via a RDBMS (1): Design

• Ever had the need to deliver messages on your queue at a certain timestamp in the future? Look no further, because your RDBMS can do it. This is part 1 of a series that builds a solution from scratch.

• In our $work project we had the need to push messages on a queue, but delayed, for delivery at a certain timestamp in the future. Our existing MQ servers aren’t adequate for that, and we can’t introduce more technology in our stack.

• Turns out, a relational database is perfectly adequate (such as MySQL or PostgreSQL). Here’s how…

Education

=> ↺ My FOSDEM 2021 presentation on how to optimize multisource historical research with tiling window managers

• For historical research and writing, the use of a dedicated tiling window manager and other customizable FOSS tools improves efficiency. With a bit of work, manuscript facsimiles, database query tools, and other items that a historian might need to have opened simultaneously can be sorted exactly how he/she wishes, freeing crucial time from organization for proper analysis. In this presentation, I explain how to optimize a multisource historical research workflow inside a tiling window manager with an entirely libre software toolkit.

=> ↺ Meet Debra Ansell: Geek Mom Projects | HackSpace #60

• You may have seen Debra Ansell’s sound-reactive LED embroidered party dress. Or her internet-connected, intelligent edge-lit acrylic light paintings. Or you may have recreated one of her builds yourself – following the instructions she generously puts up on her site geekmomprojects.com. Alternatively, you may recognise the name because almost everyone we speak to nowadays cites her as an influence on their work. We spent an hour with her talking about everything from manufacturing, creativity, and how you get from a physics PhD program to teaching kids electronics.

Programming/Development

=> ↺ Difference Between a Histogram and a Bar Graph

• Difference Between a Histogram and a Bar Graph, The Bar graph is a graphical representation of data that uses bars to compare different categories of data, whereas the Histogram is a graphical representation of data that uses bars to exhibit data by way of bars to illustrate the frequency of numerical data.

• The distribution of non-discrete variables is represented by a histogram, but the comparison of discrete variables is represented by a bar graph.

=> ↺ Seeing vs. Using

• The critique of a set of static mocks is often an exercise of indirectly-impacted technologists imagining the needs and goals of directly-impacted humans with a dynamic piece of software against a static screen of UI.

• Looking at static mocks, imagining a set of goals, and saying “yeah that looks good” is one thing. A whole other is completing a task with interactive software and saying “yeah that works good”.

=> ↺ digest 0.6.30 on CRAN: More Package Maintenance

• Release 0.6.30 of the digest package arrived at CRAN earlier today, and was just uploaded to Debian as well.

• digest creates hash digests of arbitrary R objects (using the md5, sha-1, sha-256, sha-512, crc32, xxhash32, xxhash64, murmur32, spookyhash, and blake3 algorithms) permitting easy comparison of R language objects. It is a mature and widely-used as many tasks may involve caching of objects for which it provides convenient general-purpose hash key generation to quickly identify the various objects.

=> ↺ A turn in the welding robotics community

• In early October in Denver, Colorado, the American Welding Society (AWS) held the first Automated Welding & Sensors Conference. This is a follow up to the prior National Robotic Arc Welding Conference, which last took place in 2019, but was not an official AWS conference. Since then, a lot has changed. One change is a pivot to acknowledging there is a lot going on in robotics, sensors, human robot interaction, and emerging trends in workforce education and sustainment, that it makes sense to have a conference on automation in welding.

• [...]

• Some of the key takeaways from my perspective is there is a hunger for intelligent yet easy to use solutions. There is an inherent high mix, and, at times, harsh environment. It is now at the point where collaborative robots – power and force limited manipulators – are now appearing in several job shops, and large manufacturers around the world. Caterpillar shared their experience in taking advantage of leveraging collaborative hardware-based systems to realize flexible and agile welding capability.

=> ↺ Manage Dependencies with the deps R Package for Docker Containers

• The deps package gives you a lightweight option to manage package dependencies and you can install these inside containers.

• When building Docker images for your R-based applications, the biggest hurdle is knowing exactly which packages and system libraries your package depends on. Luckily, the tools have evolved quite a bit over the past few years. In this post, I show you where the deps package fits in and how this can be a great choice for dependency management for Docker-based workflows.

=> ↺ Jussi Pakkanen: Making Visual Studio compilers directly runnable from any shell (yes, even plain cmd.exe)

• To anyone who has used unixy toolchains, this is maddening. The classic Unix approach is to have compiler binaries with unique names like a hypothetical armhf-linux-gcc-11 from any shell. Sadly this VS setup has been the status quo for decades now and it is unlikely to change. In fact, some times ago I had a discussion with a person from Microsoft where I told them about this problem and the response I got back was, effectively: “I don’t understand what the problem is” followed by “just run the compiles from the correct shell”.

=> ↺ Big Data Storage

• This is a page about some of the mechanics of ‘big data’, specifically how to store, transfer and process perhaps 100s of millions or billions of rows/events.

• [...]

• Sqlite3 turns out to have been the most suggested solution, so I gave it a spin. We want to retain the CSV goals, like low overhead, universal accessibility, robustness. Sqlite delivers on all these fronts. It for example has built in tooling for dealing with corrupted files.

• Modern Sqlite can be type safe, so it will not allow you to insert a string in a floating point field. Its support for prepared statements means we don’t have to worry about escaping.

Python

=> ↺ MLOps with vetiver in Python and R: Answering your questions

• As a follow-up to last month’s MLOps with vetiver in Python and R webinar, we’d like to highlight and answer some of the great audience questions asked during the session. You can also check out the demo and slides on the webinar’s website.

=> ↺ Send a Webmention in 10 (or fewer) lines of Python code

• Webmentions enable distributed social interactions over the web. Using webmentions, you can send replies, likes, and other interactions that were published on your site to respond to another web page. For example, I send Webmentions for all of the bookmarks I create on my website. If a site can receive Webmentions, they will be notified that I bookmarked their post for later.

• Webmentions work by sending a notification to a special server on a site called a Webmention endpoint. The endpoint will process the mention, make sure it is valid, then keep track of the mention for the site author to see. For a Webmention to be valid, there must be a link between the source (the page that mentions a page), and the target (the page that is going to receive the mention).

Rust

=> ↺ Hubert Figuière: Fall of releases

• A couple of Rust crate releases.

• Now that the new glib-rs (and gtk-rs) are out, it’s time for an update of gudev Rust bindings using the newer version of glib-rs.

Leftovers

=> ↺ Deepfake porn wrecks lives – but, as one woman discovered, it takes just 8 seconds to make an image

• After her initial shock, Kate began to realise something even more disturbing – while it was her face in the video, the body it was attached to wasn’t her own. The 30-year-old campaigner had become a victim of deepfake pornography.

Education

=> ↺ MSc: “So, You Have to Write a Literature Review”

• The end-game of my MSc is almost in sight! I’ve written up 6 assignments. Now all I need to do is write a 10,000 word dissertation in the form of a Major Project Report.

• Oh, and go through an End-Point-Assessment with my portfolio to make sure I actually know what I’m talking about.

• But, back to the report. I need to write a 1,000 word literature review. The only problem is… I’ve never done one of those before!

• Sadly, my MSc provider aren’t particularly proactive in providing resources to students – so I started looking for something to help me. I stumbled across the book “So, You Have to Write a Literature Review: A Guided Workbook for Engineers” by Berdanier & Lenart.

Hardware

=> ↺ Quickpost: Testing A Lemon Battery

• In a chat with my colleagues, we were joking about charging smartphones with a lemon battery.

• And I actually wanted to know what magnitude of electrical energy we were talking about.

• [...]

• The electronic load dissipated 0,034 Wh of electrical energy over that period. Hence, we can assume that the lemon battery delivered 0,034 Wh.

• I’m sure the lemon battery could deliver more energy, by “resetting” it: cleaning the electrodes, inserting them in another place in the lemon, …

• After a bit of searching through the web, I’m going to assume that a typical smartphone nowadays has a battery of 10 Wh. So we would need 294 times (10 Wh / 0,034 Wh) the electrical energy delivered by my lemon battery to charge a smartphone.

• Except that, the 0,9 V that the lemon battery does deliver, is by far not enough to be able to charge via the USB interface. We need 5V, so, 5,555… lemon batteries connected in series.

• On the screenshot above, you can also see that 37 mAh was measured. Notice that you can not compare this to the mAh rating of a (smartphone) battery, because both values involve different voltages.

=> ↺ Trying To Build The World’s Fastest Roomba

• A lot of people complain that Roombas are unreliable, poor at their job, or just plain annoying. Few people complain they’re not fast enough in a straight line. Regardless, [electrosync] set about building the world’s fastest Roomba for his own personal satisfaction.

=> ↺ Retrofitting Robots

• Al Williams wrote up a neat thought piece on why we are so fascinated with robots that come in the shape of people, rather than robots that come in the shape of whatever it is that they’re supposed to be doing. Al is partly convinced that sci-fi is partly responsible, and that it shapes people’s expectations of what robots look like.

Health/Nutrition/Agriculture

=> ↺ Is there really a COVID ‘nightmare variant’ spreading? Here’s what experts say

• BQ.1 and XBB — both descendants of the omicron BA.2 subvariant — appear to have similar growth advantages. But they are surging in different geographic regions, with the former mostly affecting North America, Europe and Africa while the latter has been detected in Asia.

• In the few countries where they overlap, the two strains appear to be co-circulating rather than out-competing each other.

=> ↺ Busting Myths About Privatized Healthcare

• In a private system, there’s an additional cost: profits.

• The first step towards a private system is channelling public money to private institutions.

• Patients have a similar experience, but the system is drained of resources to pay for profits…

Proprietary

=> ↺ Microsoft Edge for “Linux” uses outdated GPG and then configures it to silence your distribution’s package security checks.

• As you can see, Microsoft has essentially bypassed the GPG check by enabling the check, and then instead of installing a package signing key into the RPM database, like well behaved software does, they point it at a Public Key hosted on their server.

• The gist of this is that it shuts up the “package is unsigned” warning that prevents tampering, but then provides no assurances that Microsoft Edge updates are actually not tampered with.

=> ↺ We looked into the software support practices for 5 of the most popular smart devices (and the results may disappoint you)

• As EU policymakers are about to adopt new laws to empower consumers and increase cyber-resilience, PI’s research shows that the existing practices of device manufacturers around software and security updates fail to meet the expectations of the vast majority of consumers.

Security

=> ↺ Microsoft Confirms Server Misconfiguration Led to 65,000+ Companies’ Data Leak

• Microsoft this week confirmed that it inadvertently exposed information related to thousands of customers following a security lapse that left an endpoint publicly accessible over the internet sans any authentication.

=> ↺ Researchers Say Microsoft Office 365 Uses Broken Email Encryption to Secure Messages

=> ↺ Microsoft puts back doors in everything for the FBI and NSA

• New research has disclosed what’s being called a security vulnerability in Microsoft 365 that could be exploited to infer message contents due to the use of a broken cryptographic algorithm.

=> ↺ Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop [Windows] Malware

• The one-click attack technique is also notable in that it effectively jumps past the password barrier, enabling malicious actors to carry out a wide range of actions such as cryptojacking, data exfiltration, and ransomware.

=> ↺ Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware

• The issue, tracked as CVE-2022-22954 (CVSS score: 9.8), concerns a remote code execution vulnerability that stems from a case of server-side template injection. Although the shortcoming was addressed by the virtualization services provider in April 2022, it has since come under active exploitation in the wild.

=> ↺ From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind

• The unpacked core for the analyzed URSNIF LDR4 sample has the internal name LOADER.dll.

Integrity/Availability/Authenticity

=> ↺ wireless burglary

• Like most consumer tech products, they are also heavily cost-engineered, emphasize the appearance of features over good design, and are sometimes downright poorly thought out. Obviously I am rather critical of this generation of products, but I should make it clear that the news is not all bad: they are very cheap. There is an important trade-off here between cost and performance, and a low-cost option isn’t necessarily bad. To twist a common expression, the best burglar alarm is the one you have, and the high installation price of conventional systems has long been a deterrent.

• Let’s take a look at some of the design decisions of these consumerized alarm systems and how they relate to security properties.

=> ↺ Kakao outage in South Korea prompts security, monopoly concerns – The Washington Post

• In South Korea, Kakao is ubiquitous. Nearly everyone, from schoolchildren to the elderly, uses the Korean tech company’s apps for messaging, taxis, navigation and payments. It’s Facebook Messenger, WhatsApp, Uber, Google Maps and Venmo wrapped into one.

=> ↺ Kakao, Korea’s Everything App, Suffers Serious Outage

• It makes no sense to me why ride-hailing, payments, and messaging would fit together in a single app, but once these things get entrenched, it’s easy to see how they stay entrenched thanks to network effects.

• With Kakao in particular, there’s a concept of “multi-profiles”, where a single user can have different profiles for different groups within the platform. But as part of a data leak that resulted from their clumsy recovery from the outage, many of these heretofore private profiles were revealed, with predictably disastrous results.

Privacy/Surveillance

=> ↺ Two are better than one?! Profil.at strikes back with forced banner, when users make the “wrong” choice.

• Today, noyb.eu filed a GDPR complaint against the Austrian news magazine Profil. If you want to visit profil.at, you can reject all cookies in the first step. If one does so, however, a second banner pops up where one must agree to Google and other tracking cookies. Such forced consent is clearly prohibited under the GDPR.

=> ↺ Starlink signals can be reverse-engineered to work like GPS—whether SpaceX likes it or not

• But Humphreys wouldn’t take no for an answer. For the past two years, his team at UT Austin’s Radionavigation Lab has been reverse-engineering signals sent from thousands of Starlink internet satellites in low Earth orbit to ground-based receivers. Now Humphreys says his team has cracked the problem, and he believes that regular beacon signals from the constellation, designed to help receivers connect with the satellites, could form the basis of a useful navigation system. Crucially, this could be done without any help from SpaceX at all.

• In a non peer-reviewed paper that he has posted on his lab’s website, Humphreys claims to have provided the most complete characterization of Starlink’s signals to date. This information, he says, is the first step toward developing a new global navigation technology that would operate independently of GPS or its European, Russian, and Chinese equivalents.

=> ↺ Signal Structure of the Starlink Ku-Band Downlink

• We have developed and applied a blind signal identification technique to uncover the frequency- and time-domain structure of the Starlink Ku-band downlink signal. We further identified four synchronization sequences that can be used to passively exploit Starlink signals for pseudorange-based positioning, navigation, and timing (PNT), and explicitly evaluated two of these. The results in this paper illuminate the path to use of Starlink signals as a backup to traditional GNSS for PNT.

Defence/Aggression

=> ↺ Bernie Is Right: Extreme Wealth Concentration Has Turned America Into an Oligarchy

• A new congressional report commissioned by Bernie Sanders finds that the 1 percent now own one-third of all wealth, while the bottom half of Americans hold only 2 percent. It’s another sign of the slide into oligarchy that Sanders has warned about for years.

=> ↺ Pakistani couple arrested in Spain over daughter’s ‘honour killing’

• Pakistani authorities issued an international arrest warrant for the couple after the killing committed in April 2020, Spain’s National Police said in a statement.

• Investigators believe the couple “kidnapped and then murdered in Pakistan their own daughter because she married a person they did not like,” the statement added.

=> ↺ New York attorney accused of attacking police at Capitol [insurrection]

• Driving the news: John O’Kelly, of East Williston, Long Island, allegedly illegally made his way to the West front of the Capitol grounds where [insurrectionists] were fighting with law enforcement officers attempting to maintain a police barrier on Jan. 6 2021, per court documents filed in the U.S. District court in D.C.

=> ↺ ISW: Russian retreat from Kherson has begun — Meduza

• The Russian Army has started to withdraw its forces from the southern part of the Kherson region, writes the Institute for the Study of War in its October 21 assessment. The US think tank has been analyzing the situation at the front since the beginning of Russia’s invasion of Ukraine.

=> ↺ Administration of annexed Kherson requires residents to leave the city ‘immediately’ — Meduza

• Russian-appointed authorities of the Kherson region called on residents the city of Kherson to leave “immediately” and relocate to the left (eastern) bank of the Dnipro “because of the tense situation at the front, the increased danger of massive strikes on the city, and the threat of terrorist attacks.”

=> ↺ Millions without power across Ukraine: Russia has been attacking Ukraine’s energy system for two weeks — Meduza

• On October 22, Russia again attacked a number of energy infrastructure targets throughout Ukraine, leaving at least 1.5 million without power. Ukrenergo, the state energy company, says today’s attacks caused damaged comparable to, and possibly exceeding, the damage from Russian attacks in the days after the explosion on the Crimean Bridge. Russian strikes on the Ukrainian energy system have been ongoing since the explosion

=> ↺ Construction begins on ‘Prigozhin Line’ in Belgorod — Meduza

• Defensive structures made of concrete blocks are being installed in the Belgorod region, says regional governor Vyacheslav Gladkov.

Environment

=> ↺ Puerto Rico and Jackson, Mississippi Share Climate Injustices — and Solutions

Energy

=> ↺ RB Rail signs grant agreement with CINEA for Rail Baltica project

• Claimed to be the largest Baltic-region infrastructure project, the Rail Baltica project will cover a length of 870km in Estonia, Latvia, and Lithuania.

=> ↺ Rail Baltica completes another stage of the railway spatial planning. Here’s all you need to know

• Another stage of the Rail Baltica railway spatial planning has been completed – the specific territories, plots of land and their parts through which the Rail Baltica railway line will pass on the Kaunas-Vilnius section have been determined. All interested parties have the opportunity within two months to familiarise themselves with the prepared draft of the special territorial planning document and submit reasoned proposals.

=> ↺ [Cryptocurrency]’s Political Megadonor Has Shut His Wallet

• Sam Bankman-Fried, a 30-year-old co-founder of the cryptocurrency exchange FTX, is a $15 billion enigma. As one of the richest and most powerful men in crypto, “SBF” is already a political megadonor in the vein of Peter Thiel and George Soros: He spent millions in support of Joe Biden’s presidential campaign, and was one of the biggest Democratic donors in the country in the lead-up to this year’s midterm elections. Among his PAC’s expenditures was a whopping $10 million donation to a virtually unknown Oregon House candidate who lost his primary badly. Still, his political ambitions have had Democrats salivating: In a podcast interview earlier this year, SBF suggested that he would be willing to spend up to $1 billion on political donations before 2024.

=> ↺ Fusion vs the doomsday clock

• Both are mistakes. Let’s keep trying to fix the climate crisis and end fossils.♥

=> ↺ Why You Need Home Batteries (No, It’s Not All About Blackouts)

• The idea is simple: Store excess free energy from your rooftop in your batteries rather than selling it back to a utility that doesn’t like the idea and offers a pittance. Instead, use that stored energy later in the day during peak times to avoid the highest electricity rates while also doing your part to take strain off the grid. It’s the missing piece that makes residential rooftop solar a more comprehensive proposition.

• Some of that elegance will depend on you having a large enough solar system to charge your batteries at a healthy clip, living in a home that has plenty of sun and being a customer of a utility that forces your hand with controversial time-of-use electricity rates.

=> ↺ Opinion | Systemic Grid Failure Is Killing People in Louisiana. Voting Can Save Their Lives

• Louisiana Governor John Bel Edwards recently announced a milestone emissions reduction project. And yet, there is still no plan to mitigate the systemic grid failure that results in avoidable deaths and continues to threaten the lives of Louisianians every year.

=> ↺ Utility CEOs See Soaring Pay as Families Struggle to Afford Energy Bills

• An analysis of Securities and Exchange Commission filings by Utility Dive found that the CEO of California-based Pacific Gas and Electric (PG&E)—the largest utility firm in the U.S.—received $51.2 million in total compensation in 2021, an increase of 640% compared to her previous year’s pay.

Wildlife/Nature

=> ↺ More like a dying planet report

• Earth continues to hemorrhage biodiversity, according to the latest Living Planet Report. Unfortunately, its authors cannot manage a clear statement of how to stop the bleeding.

Finance

=> ↺ Railroad Workers Threaten to Strike and Call for Public Takeover of the Rails

=> ↺ Court Drops Landlord’s Latest Effort to Force Tenants to Move

• The news organizations were looking at Scanlon’s properties as part of an investigation into a New Jersey agency that paid him more than $1.1 million for three Atlantic City rooming houses, forcing out the residents who lived in them.

=> ↺ Appeals Court Temporarily Blocks Student Debt Cancellation

=> ↺ Opinion | To Fight Inflation, Tax the Rich and Corporate Profiteers

• The world’s central bankers, almost without exception, are now busy swinging sledgehammers. Only whopping interest-rate hikes, they’re preaching, can pound down inflation’s rising prices.

=> ↺ Opinion | Here’s the Status of Student Debt Relief as Applications Open

• Is the Biden administration doing an about-face on its student debt cancellation program? Some sensationalist headlines might lead you to believe that it is, but we believe that characterization is unfair.

AstroTurf/Lobbying/Politics

=> ↺ Why can’t Twitter stop the “Twoo Fun / Ask For Me” spam?

• Back in June, I noticed a pretty insidious piece of Twitter spam. The “twoo.fun” website was claiming that it could tell you who visited your Twitter profile.

• That’s pretty enticing! It’s what LinkedIn uses to drive its premium product. Perhaps it would tell me if a potential employer was looking at my profile? Or if my crush kept visiting it!??!?!?

• So people visited the website and signed in with their Twitter account. Whereupon the app started posting spam.

• [...]

• I keep reporting this to Twitter. And they keep shutting it down. And it keeps popping back up!

• I don’t have access to Twitter’s systems – but it seems to me like there are some easy ways to curtail this scam. At the very least blocking those two domains would force the spammers to keep moving to new hosts. Perhaps Twitter could look for new apps which suddenly start posting messages which are quickly marked as spam. Or they could do some fancy machine-learning to identify similarly scammy images.

• At the moment, we don’t know what the end-game is for this spam. Maybe is it “just” a worm and someone is having a giggle seeing how many people they can infect. Perhaps it is harvesting accounts hoping to sell them to other spammers. Or it could be slurping down the social graph for other nefarious purposes.

• Either way, this has been going on for at least five months! I think I’ve done what I can to inform Twitter. In the meantime, I urge you to warn your followers about this spam.

=> ↺ Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to theTelecommunications Act

• As drafted at time of writing, Bill C-26 would empower the Minister of Industry to compel telecommunications providers to do or refrain from doing anything in the service of securing Canadian telecommunications networks against the threats of interference, manipulation, or disruption. The legislation would authorize the Minister to compel providers to disclose confidential information and then enable the Minister to circulate it widely within the federal government; this information could potentially include either identifiable or de-identified personal information. Moreover, the Minister could share non-confidential information internationally even when doing so could result in regulatory processes or private right of actions against an individual or organization. Should the Minister or other party to whom the Minister shares information unintentionally lose control of the information, there would be no liability attached to the government for the accident.

=> ↺ At 80, John Sinclair is achy, feisty and stoned

• “It was the best day of my life,” Sinclair said of the rally. “I think I’m crazy for doing this event but you get to 50 years once in a lifetime. It’s a big deal to me. Personally, this was the biggest day of my life. So, I want to honor it.”

=> ↺ The wild night John Lennon showed up to free marijuana martyr John Sinclair

• They could have dreamed such farfetched things on Dec. 10, 1971, when former Beatle John Lennon visited Ann Arbor to perform at the successful “John Sinclair Freedom Rally” in Crisler Arena at the University of Michigan.

• The event was a peculiar and historic musical confluence of protest, pot and politics that resonates even today in Michigan’s progressive cannabis laws.

=> ↺ Trump Subpoenaed for “Central Role” in Effort to Overturn Election

=> ↺ Capturing the 2022 Wisconsin Election Climate in Photos

• Our excursion together began at a Constitution Day celebration at a community park in New Berlin, Wisconsin. The next day we were in Waukesha for a “meat-and-greet” event of food and politics at the county’s Republican Party headquarters.

Censorship/Free Speech

=> ↺ 2600 Kicked Off Of Youtube For Sarcastic Remark

• We were as surprised as anyone could have been. The notice arrived in the inbox of our Channel2600 YouTube channel and it read as follows: [...]

=> ↺ Julian Assange lawyer Jennifer Robinson asks ‘what happens when the law that is meant to protect us, silences us?’

=> ↺ The Parts Of Chelsea Manning’s Book Censored By The US Government

Freedom of Information / Freedom of the Press

=> ↺ Over 40 Journalists Detained In Iran For Covering Anti-Hijab Protests

• According to VOA, the New York-based Committee to Protect Journalists has documented that as of Wednesday, 41 journalists have been detained. A handful of them were later released on bail. Most are accused of taking part in the protests they were covering.

• But CPJ and other journalists’ rights organizations remain concerned for those behind bars, including journalists detained in Tehran’s Evin Prison.

=> ↺ Free Julian Assange!

• 3. Assange has committed no crime. He has, instead, been hounded, vilified and persecuted by the imperialist powers for exposing their war crimes in Iraq and Afghanistan, their global diplomatic conspiracies and spying operations directed against the world’s population. This has entailed unprecedented attacks on democratic rights, including the plots of the Trump administration and the US Central Intelligence Agency to kidnap or assassinate Assange when he was a political refugee in London in 2017.

Civil Rights/Policing

=> ↺ [Old] FBI Still Targets Black People for Entrapment

• The COINTELPRO era never ended, as Black people bear the brunt of FBI surveillance. The war on terror gave a new rationale for using paid informants to entrap Black people. Romeo Langhorne is the latest victim of a government created crime.

=> ↺ Twitter comes to Sana Mir’s defence after she was trolled for sharing pictures with male cricketers

• While it should have been a moment of pride for the Pakistani cricket fans to see our athlete representing the nation and sharing the same stage as these big names in men’s cricket, unfortunately, all social media users could comment on was how she was the only woman in a pool of men.

=> ↺ Saturday is Finno-Ugric tribal day, flags raised

• The tradition dates back to 1931, when the third week in October was set aside to look at the culture and society of all Finno-Ugric peoples, which includes not only Estonians but also Finns, Hungarians and many other national groups, whose homelands are predominantly located across the present-day northwestern Russian Federation and northern Scandinavia, and their diaspora populations in North America and elsewhere.

=> ↺ Iran schoolgirl dies after being beaten by security forces, teachers’ union says

• A 15-year-old Iranian girl died last week after being beaten during a raid by the security forces on her school, a teachers’ union said, urging the authorities to stop killing “innocent” protesters.

=> ↺ Being Pregnant in Prison Is a Nightmare That Won’t Be Ended by One Bill Alone

Internet Policy/Net Neutrality

=> ↺ Reflections on the ITU Plenipotentiary Conference 2022

• The ITU’s most important meeting, the Plenipotentiary Conference, just wrapped up in Bucharest after three weeks of ceremony, intense negotiations, and elections for an all-new leadership team. Read on for some of the key takeaways for the Internet community.

Monopolies

Copyrights

=> ↺ Department of Piracy: Punish Russia’s Enemies, Boost Morale, Hurt Pirates

• A new proposal emerging from the Russian parliament’s Committee on Economic Policy could have global implications for the entertainment industries, movies in particular. The scenario envisions a state-sanctioned ‘Department of Piracy’ that would obtain copyrighted content unavailable by legal means, so that the state can sell it to the public.

=> ↺ A concept that should not exist at all is already implemented: the “paying” public domain

• couple of weeks ago, Walled Culture reported on a terrible idea in France: requiring companies to pay for the use of public domain material. As the post explained, this is a subversion of what it means for something to enter the public domain, and a betrayal of the implicit bargain of copyright. Fortunately, the plan was dropped, partly as a result of the outrage it generated.

• Naively, I assumed that this was a lucky escape, but that the idea would be back unless we were on our guard. I was wrong: the idea won’t be back, because it has already been implemented in a number of other countries. For example, Jorge Gemetto pointed out on Twitter that something called the “paying” public domain has existed in Uruguay and Argentina for many years. He linked to an interesting article on the topic by Maximiliano Marzetti, who lists even more countries blighted by this copyright perversion: Algeria, Kenya, Ruanda, Senegal, Republic of the Congo, Côte d’Ivoire, and Paraguay. Marzetti refers to a 2010 report from WIPO, which explore the idea of the “paying” public domain further.

=> ↺ Record industry clamps down on AI-based music extractors that infringe on copyrights

• The files that these services produce are either unauthorized copies or unauthorized derivative works of the labels’ copyrighted music, the organization says as it identified three websites that allegedly serve as music extractors.

• They include Acapella-extractor, which amassed 3.2 million site visits in the last 12 months; Remove-Vocals, which had 2.6 million visits in the past year; and Songmastr, which recorded 32,000 visits in the last six months since its launch.

• All three sites are registered by Toronto, Canada-based Contact Privacy Inc.

=> ↺ Major Labels Now Targeting ‘AI-Based Extractors/Mixers’ for Copyright Infringement

• The Recording Industry Association of America (RIAA) has submitted its most recent overview of notorious markets to the U.S. Trade Representative. Most of the well-known culprits are present, from torrenting to cyberlockers. A new addition in this report is ‘AI-based’ music mixers and extractors as something to watch as an emerging threat to the industry.

=> ↺ Record Labels Say AI Music Generators Threaten Music Industry

• Artists working within all kinds of media have raised concerns in recent years—and increasingly, with the rising popularity of text-to-image generators like DALL-E—about whether AI-generated art infringes on individuals’ copyright. Most AI content generators depend on datasets that are filled with original artworks, texts, or audio, and use those original works without the owners’ permission.

=> ↺ Why the Real Bill C-18 Threat is Bill C-18

• Facebook is a hard company to support. Earlier this week, I attended an excellent talk with Frances Haugen, the well-known Facebook whistleblower, who delivered a compelling case that the social media giant, driven by profit maximization, consistently errs on the side of technical choices that keeps users engaged, angry, and on the platform, often at an enormous societal cost. Haugen identified numerous harms associated with the company’s practices – privacy, the impact on children, misinformation, and algorithmic settings that often inflame rather than educate – and emphasized that there was a need to address these concerns through better regulation (notably transparency and privacy rules).

• Haugen’s talk came to mind yesterday as Facebook released a blog post confirming that it had not been invited to appear before the Canadian Heritage committee studying Bill C-18, outlining its concerns, and making it clear that it was starting to think about the prospect of blocking news sharing in Canada:

• faced with adverse legislation that is based on false assumptions that defy the logic of how Facebook works, we feel it is important to be transparent about the possibility that we may be forced to consider whether we continue to allow the sharing of news content in Canada.

=> ↺ Government Moves to Block Dozens of Potential Witnesses as it Shuts Down Bill C-18 Hearings

• Earlier this year, the government deployed disturbing anti-democratic tactics by repeatedly cutting off debate on Bill C-11 in both the House of Commons and during clause-by-clause review of the bill. As a result, MPs rushed to vote on over 150 amendments, most without public disclosure of what was even being voted on. That approach rightly sparked anger and has even led supporters of Bill C-11 to ask the Senate to remedy unexpected amendments that were not subject to any public debate. As bad as that was, later today the government will arguably engage in an even more problematic tactic, as it moves to block dozens of potential witnesses from presenting their views on the Online News Act (Bill C-18).

• Minutes after Canadian Heritage Pablo Rodriguez answers committee questions on the bill for the very first time this afternoon, the government – backed by the NDP – is expected to shut down further witnesses at the Bill C-18 hearings and move directly to clause-by-clause review. As a result, dozens of stakeholders and experts will be blocked from giving testimony to the Heritage committee. For a government that once prided itself on consultation, the decision to block further committee testimony is a remarkable abdication of the principles of a consultative, inclusive approach to legislative development.

• The decision to shut down witnesses at the Bill C-18 hearing is particularly problematic given the importance of the bill (it has major implications for the free flow of information online and an independent press), the myriad of concerns (payments for links, risk to increased clickbait and misinformation, government intervention), and the Parliamentary Budget Officer’s estimate that the majority of revenues will go to the CBC and broadcast giants such as Bell.

=> ↺ Small Business Weak: Why Bills C-11 and C-18 Undermine the Government’s Claims of Small Business Support

• As anyone watching the House of Commons this week knows, it is Small Business Week. Each day, Liberal MPs have stood in the House to proclaim their support for small business. The speeches are supplemented by tweets, such as this one by Canadian Heritage Minister Pablo Rodriguez. The professed admiration for small business came to mind last night during a spectacular Senate hearing on Bill C-11 featuring Jennifer Valentyne, Stewart Reynolds (aka Brittlestar), and Darcy Michael. The three witnesses, who were bursting with energy and confidence, came with simple message: fix Bill C-11 by keeping the government and CRTC away from the platform algorithms. It is a message that Rodriguez has ignored for months, despite the fact that these are precisely the creators one would think the Minister of Canadian Heritage would want to support.

• The panel provided a reminder that these are more than just supremely talented creators who have parlayed Internet platforms and global audiences into great success, however. They are also small businesses. Working alone, with a partner, or a small team, each is a small business that generates employment, brings new revenues into Canada, and – to use Rodriguez’s language – bring dynamism and ingenuity.

Gemini* and Gopher

Personal

=> ↺ taking in a merino top

• i am tall but not wide person. to get the length in clothes that i need i often go up a size; this will then be too wide on me:-( i have put up with this for my life so far. one of my motivations for starting to sew (machine) was to have better fitting clothes that i had either modified or made myself.

=> ↺ Job Woes

• The car is fairly messed up. The accelerator just intermittently stops working, which is not great! When it is working, I can be cruising at a consistent speed and the RPMs suddenly go up to 5000 just to maintain. Yikes-a-roni.

• [...]

• I really do need to find work that’s not gig economy bullshit, but I’m so fundamentally unsuited for employment. I have no patience, I can’t stand up for hours on end, I can’t do heavy labor… I thought maybe I might apply at a local cafe, but the questions on their application include “What is your favorite TV show” (haven’t watched one in years) and “What is the best concert you’ve ever been to?” (have literally only ever been to random classical orchestra concerts, and not even very many of those).

Politics

=> ↺ I Don’t Understand What I’m Reading

• The Guardian informs me that Suella Braverman has resigned, stating….

Technical

=> ↺ How I feel after getting ‘let go’ by my former employer

• Honestly, after the dressing-down I received, I should have refused to work with N. P.; I should have spit on his shoes and driven home.

• I hope the board will get in touch with me. I have some things I’d like to say.

• Finally, here’s a sample of the feedback I received from N. P. when he was my supervisor. I have lightly edited it to remove personal information, but otherwise have kept it as I received it. Please note that I’m not a prescriptivist, but what he sent me was the worst attempt I have ever seen at communication in a professional context.

=> ↺ My new used ThinkPad T460s

• Finally I got my hands on a used and refurbished ThinkPad T460s. I got it for ~350€ from an Amazon Seller. After some troubles involving sending the first package back (the laptop was completely broken), I got a fully functional and as good as new T460s.

• I was long thinking about getting a new laptop for experimenting and testing purposes, so I don’t need to use my daily driver/gaming laptop for this. An older ThinkPad is the ideal device to tinker around in my opinion.

• What I mainly want the T460s for is checking out all kinds of free operating systems on bare metal. That will be a better experience than using VMs I believe.

• Gemini (Primer) links can be opened using Gemini software. It’s like the World Wide Web but a lot lighter. Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

=> Techrights

➮ Sharing is caring. Content is available under CC-BY-SA.