- Talk - lists.gtalug.org

supply chain risks: a real example
by D. Hugh Redelmeier 18 Mar '22

18 Mar '22

Supply chain risks are important in open source: with so many contributors, how can one be sure that there aren't malicious components? (Buggy components are also a threat.) (Closed source has this problem too, with some variations.) This is a scary real current example: <https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-pack…> As I understand it, this malicious software tried to damage systems in Russia and Belarus. That's terrible. And it has had unintended side-effects: <https://web.archive.org/web/20220317140340/https://github.com/RIAEvangelist…> (One could also argue that leaving important information in Belarus, with no recent backup, is a very dumb.)

3 3

Vulcan Information
by Nicholas Krause 12 Mar '22

12 Mar '22

Greetings Hugh, I was playing around with Vulcan awhile ago and these may be of interest: Vulcan Tutorial: https://vulkan-tutorial.com/ Khorno's Maintained Github of Vulcan Examples: https://github.com/KhronosGroup/Vulkan-Samples I've looked through it briefly and there are lots of various types of examples. From playing around it seems you need to have a working knowledge of certain parts of C++17 or later. Not sure this helps with your interest in GPU programming, Nick

1 0

two or three tricks for installing Linux as a second OS on a Windows box
by D. Hugh Redelmeier 09 Mar '22

09 Mar '22

Most computers come with Microsoft Windows. If you insist on buying a computer without Windows, you have less choice and may have to pay more. Besides, once in a blue moon Windows is useful. To install Linux, you can either blow away Windows (easy!) or your can install Linux beside Windows. If you want to install Linux beside Windows, you usually have to get Windows to relinquish some disk space. (Alternatively you might be able to add another disk.) Windows has a way of reducing the size of a volume but it is unwilling to relocate a structure that is in the middle of the volume. So it is only willing to give up slightly less than half of the volume. I use gparted (ntfresize is underneath) to shrink a Windows NTFS volume, because I always want to shrink in to less than 50% of its original size. I do this from a live Linux flash drive. Here are the tricks that are not so obvious: - if Windows is using bitlocker, you need to turn that off in Windows. Otherwise gparted cannot do anything with the partition. Our newest computer came with bitlocker enabled (with no password). That's probably a good idea but not for us. After bitlocker is turned off, gparted can operate. Perhaps you can turn it on again after resizing. I don't know. (On Windows: Settings: Privacy & Security: Device Encryption) - By default, Windows assumes that it can leave the filesystem in an inconsistent state when it shuts down. It assumes that you'll boot Windows again when you power the system up. Apparently this speeds things up a little bit. This is very unhealthy if you are going to boot Linux next, especially if you are going to run gparted to muck with the NTFS filesystem. You can fix this by going to Windows' Control Panel (which is something different from Settings), Power Settings, and untick "turn on fast startup (recommended)". It is slightly tricky because you have to click some option to allow you to change the fast startup option. Sheesh. - (old advice; may be obsolete; I don't wish to find out the hard way that it is still needed.) After you have resized the NTFS partition, reboot to Windows. Don't do anything else with the disk in Linux first. Why: it used to be the case that gparted got something slightly wrong in the NTFS partition, something that a Windows boot fixed silently. After booting Windows, you can reboot to a Linux install medium safely.

7 9

keeping my systems updated: Windows vs Linux
by D. Hugh Redelmeier 09 Mar '22

09 Mar '22

I want to keep my systems up to date. Not everyone does. As I understand it, Windows Update does not update the Linux portion. Yet another step to keep a Windows system safe as possible. My drill: - Run Windows update. If it actually applied an update, you should run it again in case the update enables a subsequent update (you cannot tell by its cheerful declaration that your system is up to date). Rinse and repeat. BTW, Windows Update seems unreasonably slow. And prone to inscrutable failures. - go to the Microsoft App Store and get updates. Be careful, it too can prematurely say that your apps are up to date. - ask the machine vendor's software if it has driver or firmware updates (Dell, Lenovo, HP, ...). Sometimes I have to manually download and install firmware updates. - for WSL: "sudo apt update" and "sudo apt full-upgrade" - for each piece of third party software, ask it if it has updates. This includes FireFox. My Linux drill: - [Fedora] "sudo dnf update" [debian family] "sudo apt update" and "sudo apt full-upgrade" - once in a while: "sudo fwupdmgr get-updates". If the vendor doesn't support the Linux Firmware project, another process is required (maybe involving Windows). Linux sure wins here!

2 3

Package Manager upgrades on Linux
by Giles Orr 08 Mar '22

08 Mar '22

This is curiosity on my part and not meant to start a massive debate. I apologize should it do so. I started using Linux with Slackware. That wasn't really a "managed package system" at the time - you just unpacked tarballs. I moved to RedHat, where "rpm" was a huge improvement in package management over Slackware. But rpm was subject to "dependency hell," which wasn't much fun. I switched to Debian, where I was impressed by the superior "apt-get". These days I use both Debian and Fedora. Debian has moved to "apt" (not terribly different from "apt-get"), while RedHat/Fedora first came up with "yum" (painfully slow, but eliminated "dependency hell"), and then moved on to "dnf" which I'd say is almost as fast as "apt" - even though it's mostly an abstraction layer on top of "rpm" (as was "yum"). Just recently I started using Arch on one of my machines. Arch is a rolling release, and has fairly high package turn-over. If I leave the machine alone for a couple weeks and tell it to do a full upgrade (their package manager is called "pacman"), it usually comes back with "have to download 650M packages." My reaction the first couple times was "Damn, I'd better go get a coffee!" Only to find that by the time I stood up and started heading for the door ... it was finished. "apt" and "dnf" should hide their heads in shame. Fedora and Debian could learn a hell of a lot from whatever pacman is doing to fly through package installations perhaps four times faster than their package managers. So my questions (yes, there are questions here): does anyone know of other package management systems? I suppose I'm thinking of OS-specific ones rather than flatpak or snap. How fast are those other systems relative to those already mentioned? And do we have any full-time Arch users on the list? Contrary to this discussion, my decision of what Linux distro to install and use isn't primarily based on the package manager's speed. Installing Arch in 2021 was a lot like installing Slackware in 1998: I had to research and type dozens of commands in a shell just to get a functional system, and at that I'm not entirely sure I did all the security stuff right - which is more than a little alarming. But I think they have the best documentation of any distro in existence (which made that tricky install possible), and a really excellent package manager. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

3 2

[GTALUG-Announce] GTALUG March Meeting Reminder
by Alan Heighway 07 Mar '22

07 Mar '22

*When: *Mar 8, 2022 7:30PM *Speaker:* Trevor Woerner *Topic:* Update Strategies for Embedded Devices *Location:* https://blue.lpi.org/b/eva-zjc-gjy-kgl For various reasons, the strategies for performing a software update on an embedded device have diverged from what is commonly done on the desktop. This talk will discuss why, introduce the most common embedded strategies currently in use, and how to employ them. *A*lan *H*eighway <http://heighway.ca/> heighway.ca VA3WAH / VA3YKZ [image: Please consider the environment before printing] --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

1 0

Sane Email System?
by Peter King 05 Mar '22

05 Mar '22

Hello! I've just been informed that "legacy authentication" is going to be disabled at the University of Toronto for my email account. Well, I suspected something like this was in the works when they adopted MS Outlook 365+ as the mail server, but it still isn't welcome. Up to now, I've been able to use mutt and getmail for all my needs; I run a daemon that picks up (and then deletes) email from a variety of servers (University of Toronto, GMail, and so on) onto a single computer. There I apply all the filters, spam protection, sorting into various inboxes, and so on. To read email I just ssh in from any computer anywhere and run mutt. All configurable with nice text-based scripts. The email files are automatically backed up and sychronized to other computers, too. When I'm out of town I have the mail be downloaded/deleteed manually, and I have full fallover capability, so if one machine is offline I can switch to another without any hiccups. But it looks like that is all going away, since Microsoft only supports what they call "modern" email clients, and on Linux only Thunderbird. I could switch. But then rather than the fetch-and-store model, which has worked fine over the years, I would either have to change to a view-in-a- browser model (and so have to be running a GUI locally and store all my email somewhere else out of my control), or chuck my university email account and set up something else. At the moment I'm really inclined to do the latter. I'll just set up some way of forwarding all my email to some text-based *NIX server somewhere that is happy to let me run scripts to deal with email. But maybe I'm not being fair to the former alternative. I have *no* experience with any of the "modern" email clients, and have been stubbornly clinging to the plain ASCII text as how email should work. Maybe there are perfectly reasonable email clients these days with powers I know nothing of. (I am currently teaching a few courses at UCLA and was forced to use their webmail system, run by Google, and I have to say I despise it: graphical for no good reason, with limited search/sort capabilities, threading of old messages not clearly visible, and so on.) Any advice, suggestions, hints? War stories? Ways to thwart the powers that be? Thanks in advance. -- Peter King peter.king(a)utoronto.ca Department of Philosophy 170 St. George Street #521 The University of Toronto (416)-946-3170 ofc Toronto, ON M5R 2M8 CANADA http://individual.utoronto.ca/pking/ ========================================================================= GPG keyID 0x7587EC42 (2B14 A355 46BC 2A16 D0BC 36F5 1FE6 D32A 7587 EC42) gpg --keyserver pgp.mit.edu --recv-keys 7587EC42

12 12

Blog Post on Rust Projects Initiatives for 2022 and Other Things
by Nicholas Krause 28 Feb '22

28 Feb '22

Greetings, I'm not sure if this is of interest to anyone, but the LLVM weekly upgrade posted this: https://blog.rust-lang.org/inside-rust/2022/02/22/compiler-team-ambitions-2… It's the Rust's project blog post on the projects being attempted for this year. If people want to keep up with LLVM this may help: https://llvmweekly.org/. It's a weekly digest emailed to you of the major weekly updates. I believe either Hugh or Lennart asked but the LLVM project has replacements for all the standard toolchains normally given by GCC. So there is a debugger, ldb and linker,lld if I recall the names correctly. A little older but LLVM is changing the license to Apache 2.0 with an LLVM expection: https://blog.llvm.org/posts/2021-11-18-relicensing-update/. Cheers, Nick

1 0

Positions at Toronto Public Library
by Giles Orr 24 Feb '22

24 Feb '22

Two positions are being advertised in my immediate department, should anyone be interested. https://www.linkedin.com/jobs/view/2926612537/ - ITS Lead, Digital Products https://www.linkedin.com/jobs/view/2926616569/ - Dev/Ops Analyst Feel free to contact me if you have questions. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

1 0

Firmware Test Suite
by D. Hugh Redelmeier 21 Feb '22

21 Feb '22

UEFI firmware is quite complex and abstruse. It is easy for a vendor to get it wrong. As long as Windows seems to run, ship it. I just discovered the Firmware Test Suite <https://wiki.ubuntu.com/FirmwareTestSuite/> It acts as a lint for firmware. It detects some violations of standards (such as ACPI). Although it is a Ubuntu / Canonical project it can run on other Linux systems or even from a stand-alone bootable image. To install it on Fedora: sudo dnf install fwts Probably the only thing you can do with the result is fling it at your vendor. It might also give a consumer insight into the quality of the firmware engineering.

1 0