- Talk - lists.gtalug.org

npm and the worm...
by Colin McGregor 29 Dec '25

29 Dec '25

For those who don't know, npm is a JavaScript library manager that makes installing, managing JavaScript library programs much easier. npm is available on a number Linux distributions, Debian, Ubuntu, RedHat and a number of others. In my case my concern is doing some software development on a Raspberry Pi using Raspberry Pi OS (a Debian variant) using npm to bring in a library program that makes it more-or-less painless to bring in a library program that converts .xml files to .json files. npm does what it was supposed to, bringing in JavaScript, but it makes a false assumption that software developers are NOT malicious. Since September 2025 security researchers have been aware of a worm program dubbed "Shai-Hulud 2.0" (named after the giant worm in Frank Herbert's science fiction novel "Dune"), details here : https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ . Shai-Hulud 2.0 can do a number of things, all of them bad. So, how can you protect yourself from Shai-Hulud 2.0 when using npm?

2 1

(info) Mint vs LMDE vs Kubuntu -- speed
by William Park 27 Dec '25

27 Dec '25

Just FYI... While compiling kernels for BeagleBone Black and Raspberry Pi Zero 2W, I encountered the following speed ranking: - Kubuntu -- bronze medal (~130min) - Mint -- silver medal (~120min) - LMDE -- gold medal (~110min) I don't know why there is difference between Kubuntu and Mint. Both are on LTS base, and kernel compile doesn't go through desktop.

2 1

What's going on with Linux kernel?
by William Park 15 Dec '25

15 Dec '25

(Double posted, so reply to your list) What's going on with Linux kernel? v6.18 was just released, and it's moving to v6.19.

2 1

Fwd: safety warning on zoom: STOP fireflies.ai
by CAREY SCHUG 13 Dec '25

13 Dec '25

Maybe this is only a serious issue with people hosting meetings, I do not know. See below for further information. Once it gains access to your calendar, it will attempt to join other sessions. DO NOT LET IT JOIN or kick it out. and warn attendies to REFUSE it. It might be wise to turn on the waiting room so as not to let it in. There is apparently an add-on to zoom (and other conferencing sessions) called fireflies, purportedly doing an AI analysis of your session. It will try to act like it is part of the session and ask attendees to click and approve it, infecting them. An AI search seems to indicate it is hard to get rid of. As an attendee, in the session where I clicked "yes" thinking the host supported it, I deleted all cookies; I do not know if that was sufficient. Here are the full AI instructions to remove it if you get infected. Since it seems to update your Zoom account, a complaint should probably be made to them to not allow that (by somebody paying them money). To remove yourself from Fireflies.ai, follow these steps: 1. Disconnect from Meetings: If Fireflies is integrated with your Microsoft Teams or Zoom meetings, disconnect it through the Fireflies settings page. In Teams, scroll to the bottom of the Fireflies settings and click "Disconnect". In Zoom, go to the Zoom App Marketplace, sign in, click your profile icon, select Manage, then Installed Apps, find Fireflies.ai, and click Uninstall. 2. Delete Your Account: Log in to your Fireflies web app, navigate to Settings > Account Settings, and scroll down to the "Delete Account" section. Click "Delete my account". You will be prompted to select a reason for leaving and can optionally provide feedback. Confirm the deletion when prompted. 3. Account Deletion Process: Your account will be deactivated immediately, but the permanent deletion of your data will occur after a 30-day grace period. During this time, you can contact support to recover your data if needed. After 30 days, your data will be permanently erased and cannot be recovered. 4. Remove App Integrations: Ensure all linked integrations, such as calendar connections, are disabled to prevent lingering access. 5. Uninstall the Application: If you have the Fireflies app installed on your computer, uninstall it. On Windows, go to Settings > Apps > Installed Apps, search for Fireflies.ai, click the three dots, and select Uninstall. On Mac, open Finder, locate Fireflies.ai in the Applications folder, drag it to the Trash, and empty the Trash. 6. Remove Browser Extensions: If you have the Fireflies extension installed in your browser, go to your browser's settings, navigate to Extensions, find Fireflies.ai, and click Remove. 7. Check for Residual Files: Search your computer for any remaining Fireflies.ai files. On Windows, search for %AppData% in File Explorer and delete any related folders. On Mac, check ~/Library/Application Support/ and remove any Fireflies.ai-related files. 8. Admin Actions (if applicable): If you are an administrator and need to block Fireflies for your organization, you can do so through the Microsoft Teams Admin Center by managing apps and blocking Fireflies.ai, or through Google's API controls to block traffic. Further information: The presence of Fireflies.ai in Zoom and other online sessions is considered a serious privacy and security concern by users and IT administrators alike. The issue stems from Fireflies.ai's ability to join meetings unexpectedly, often without explicit user consent, due to its integration with calendar services like Google Calendar and Outlook. This behavior has been described as "creepy" and invasive, with users reporting that the bot appears in meetings even after accounts are deactivated or the app is uninstalled. A major concern is that Fireflies.ai can gain access to meetings through calendar integrations, allowing it to auto-join meetings it knows about, even if the user never authorized it. This persistence is likened to a "plague" that is difficult to remove, with some users stating that simply disconnecting the app from their calendar or removing it from Zoom's app marketplace does not fully stop its intrusion. The issue is compounded by the fact that the bot may have already been granted access to previously scheduled meetings, requiring manual removal from each event. The situation is particularly problematic for organizations, as Fireflies.ai can automatically join meetings across a company's network if a single user has previously connected their account, potentially exposing sensitive information. Despite attempts to block the app via API controls or admin settings, some users report that Fireflies.ai continues to join meetings, indicating that the issue may not be fully resolved by standard administrative measures. Furthermore, the bot's behavior raises legal and compliance concerns. Users are legally responsible for ensuring that all participants consent to being recorded, and if Fireflies.ai joins a meeting without consent, the host could face liability. This is especially critical in contexts involving healthcare, legal, financial, or government discussions where confidentiality is paramount. In summary, the "infection" of Zoom and other online sessions by Fireflies.ai is serious due to its invasive auto-join behavior, difficulty in removal, potential for unauthorized recording, and the legal risks it poses to users and organizations. My experience: I joined a session, it asked me to approve it, in the process it asked me for access to my calendar, which I turned off. it then asked again, without the option to refuse access to my calendar. Since I thought it was something the host wanted, i accepted. I am sure others will have accepted the first time. When the host said she did not know what it was, I deleted all cookies, but I do not think that is sufficient. I have made my Google calendar private; if you can do that, it is probably wise. to do that, click on the gear at the upper right of your calendar page click "settings" under settings for your calendars, click on your calendar under "access permissions for events" UNclick "make available to the public" Carey

3 4

Videos of December KW-LUG meeting
by D. Hugh Redelmeier 12 Dec '25

12 Dec '25

I found the two talks very interesting: - perty planning with open source software [with exceptions] = Cycling Guide application (doesn't cover Toronto :-) > From: Mikalai Birukou via kwlug-disc <kwlug-disc(a)kwlug.org> > To: KWLUG discussion <kwlug-disc(a)kwlug.org> > Cc: Mikalai Birukou <mb(a)3nsoft.com> > Date: Thu, 11 Dec 2025 14:33:21 +0000 > Subject: [kwlug-disc] Videos of December meeting > > All videos are here: https://archive.org/details/kwlug_meeting_2025-12-01

1 0

looking for a recent trusted review of available analogue telephone adapters.
by CAREY SCHUG 10 Dec '25

10 Dec '25

I think my landline provider is going to discontinue my wired service soon. While a search lists many websites with "evaluations", I don't know which are impartial and which are promote one brand or another. I'd also like a table of features, I'm not sure if everything I would want is automatic. what I think i want, but maybe ignorance means i should require something else, or one of these things is foolish --battery backup --want to connect 2 phones, a minimal old style just to always be there --my current cordless base station for which I have 7 more remotes working off the same base. --ability to connect to the hotspot from my mobile if/when the wired internet access fails. --or tethered from my mobile? is it possible to use tethering from my phone to replace the entire wired network at home? Sorry, I'm ignorant, and is there an auto switch to go between my wired internet router and my home switch to make the crossover automatic in both directions? A google search says only the router can switch between one WAN and another, but it seems to me some smart person could make a minimal switch with that capability, since my router belongs to the cable company and I doubt they would want to make a failover to somebody else's internet as a source. If they do, I'm sure they'd charge an extra $100 per month even if i never did it. Almost certainly more change than I would be ready to make, but is there an open source switch setup to which some smart person has added a heartbeat monitor on the primary wan and will swtich to a second if the primary is down for some interval? Looks like I'll probably have to be happy with manually switching, as in... --Comcast cable internet goes down and stays down. --unplug it from my primary switch --have a Linux computer with bridging software idling to a USB port (or second Ethernet port?) --enable tethering on my phone and connect it to the bridging computer I assume the bridging software handles dynamic IP addresses, or is that actually built into the tethering on the phone? Carey

4 5

(wanted) BeagleBone Black
by William Park 10 Dec '25

10 Dec '25

My BeagleBone Black just died. A new one will probably arrive next year, considering holiday shipping and postal strike. So, anyone who wants to sell their BeagleBone Black (old 2GB or new 4GB), contact me off-list.

2 4

Join up for tonight's AGM
by D. Hugh Redelmeier 09 Dec '25

09 Dec '25

The Annual General Meeting is tonight! Members get to vote. To be a member, you need to pay modest dues. It's easy. Here's what Warren wrote last year: > From talk(a)gtalug.org Tue Nov 12 17:03:58 2024 > From: Warren McPherson via talk <talk(a)gtalug.org> > To: Announce(a)gtalug.org > Date: Mon, 11 Nov 2024 20:47:03 -0500 > Subject: [GTALUG] [GTALUG-Announce] GTALUG Membership Dues > > With the AGM arriving, please remember to send in your dues. > It is easy to do. > In your bank's online app, select Interac e-Transfer. > Send $20 to "membership(a)gtalug.org" > > Thank you!

1 0

REMINDER:
by Alan Heighway 08 Dec '25

08 Dec '25

AGM: 1. Year in Review 2. BOD Nominations and Election if required 3. Financial report 4. Adjournment Description: We are coming to you to tell us about your favorite tech related toy or software. For our December meeting, we’re turning the spotlight over to *you*! We’d love for each member to share a favorite tech-related toy, tool, or piece of software. It doesn’t have to be strictly computer-based—anything that scratches your tech itch is fair game. Tell us *what it is*, *what it does*, and most importantly, *why you enjoy it*. Maybe it’s a gadget that makes life easier, a piece of software you can’t live without, or even a clever non-digital device that satisfies your inner tinkerer. Come ready to show it off, share your enthusiasm, and maybe even inspire someone else’s next favorite tech treasure! Speaker: All of you! *Agenda*: 1. AGM / Business Meeting 2. Presentation 3. Discussion 4. Adjournment *Date / Time:* December 9th, 2025 19:30 EST *Location:* *In Person*: TMU George Vari Engineering and Computing Centre, 245 Church Street (just north of Dundas), Room 201 (See note below) *Online using Nextcloud:* https://hub.gtalug.org/call/7m45sf9i *NOTE:* The doors to the building are normally locked. There will be someone from GTALUG at the doors on the southeast corner of Church and Gould to let people in. If you come late or don't see anyone at the door please SMS at 647 657 6575 for THIS NIGHT ONLY. Do not call. *A*lan *H*eighway <http://heighway.ca/> [image: Please consider the environment before printing]

2 1

(question) Where to get cheap/free 22AWG solid wires
by William Park 04 Dec '25

04 Dec '25

(Double posted, so reply to your list) Anyone know where to get cheap/free 22AWG solid wires? This is for breadboards, headers on embedded boards, short test leads, etc. It would be nice if they come color coded and bundled, but singles are okay. FYI, this is where I get my supply of cheap/free wires: 1. 18AWG -- Old ATX power supply has lots of color coded 18AWG stranded wires. *Con*: Their plastics insulation melts too easily compared to other wires that you'd buy separately. 2. 24AWG -- Old network cable has 4 pairs of 24AWG solid/stranded wires, nicely bundled. 3. 24AWG -- Old phone cable has 2,4,6 solid wires, nicely bundled. 24AWG (I think).

2 1