Linus Torvalds Shows His New Polite Side While Pointing Out Bad Kernel Code

Found on Phoronix on Saturday, 03 November 2018
Browse Software

Today he took issue with the HID pull request and its introduction of the BigBen game controller driver that was introduced: the developer enabled this new driver by default. Linus Torvalds has always frowned upon random new drivers being enabled by default in the kernel configuration driver. Today he still voiced his opinion over this driver's default "Y" build configuration, but did so in a more professional manner than he has done in the past.

So far it looks like Linus' brief retreat is paying off with still addressing code quality issues -- and not blatantly accepting new code into the kernel as some feared -- but in doing so in a professional manner compared to his past manner of exclaiming himself over capitalized sentences and profanity that at time put him at odds with some in the Linux kernel community.

Not sure if a "softer" Linus is better; at least in the past it was very obvious when he considered something wrong.

Mac users burned after Nuance drops Dragon speech to text software

Found on The Register on Tuesday, 30 October 2018
Browse Software

Pitched as a productivity tool, Nuance's Dragon software is aimed at everyone from journalists and home users to medical professionals as a way to accurately transcribe spoken words into printed text.

For some users, however, the software is much more than a convenience. Hughes explains that, for him and others whose conditions leave them unable to type with a keyboard, voice dictation software is a line to the outside world.

"Nuance is constantly evaluating its product portfolio to see how we can best meet the needs of our customers and business. After much consideration, we have made the difficult decision to discontinue the Dragon Professional Individual for Mac line-up," the statement reads.

Difficult decision? Some beancounters probably calculated that supporting it does not generate enough revenue.

This is fine: IBM acquires Red Hat

Found on Ars Technica on Monday, 29 October 2018
Browse Software

Red Hat will remain a standalone business unit within IBM, and an IBM spokesperson said that IBM "will remain committed to Red Hat’s open source ethos, its developer community and its open source community relationships." Red Hat will maintain its current leadership team and remain in its current headquarters and facilities. The culture will remain as well—though it's possible IBM and Red Hat may cross-pollinate a bit more than they have in the past.

This isn't good news for everybody. Generally, such aquisitions end with restructuring, layoffs and other changes. Sure, IBM can promise all it want, but the question is if in a few years these promises will be worth anything when all that counds are numbers for the stock markets and shareholders.

The D in Systemd stands for 'Dammmmit!' A nasty DHCPv6 packet can pwn a vulnerable Linux box

Found on The Register on Saturday, 27 October 2018
Browse Software

The flaw therefore puts Systemd-powered Linux computers – specifically those using systemd-networkd – at risk of remote hijacking: maliciously crafted DHCPv6 packets can try to exploit the programming cockup and arbitrarily change parts of memory in vulnerable systems, leading to potential code execution. This code could install malware, spyware, and other nasties, if successful.

Though a number of major admins have in recent years adopted and championed it as the replacement for the old Init era, others within the Linux world seem to still be less than impressed with Systemd and Poettering's occasionally controversial management of the tool.

The question is, why would someone stuff anything network related into what was supposed to be an init replacement? Or all the other crap SystemD contains? Another question is why they wrote DHCPv6 from scratch when IPv6 does not really need DHCP since it has Stateless Address Autoconfiguration (SLAAC) and Neighbor Discovery Protocol (NDP).

Sony goes back on 11-year-old promise to keep Warhawk servers up

Found on Ars Technica on Wednesday, 24 October 2018
Browse Software

If you read Ars Technica (or simply play online games regularly), you're probably accustomed to game makers shutting down online gameplay servers at will, often with little-to-no notice.

Lorenzo B. signed the petition and described himself as "a player of 10 years who has spent money on the game and spent money on all the added extra maps, too. It is important to me to get what I paid for, and what I paid for is the Warhawk game that is now offline on the PlayStation network."

Remember, you're not buying a game; you're just paying money to be allowed to play as long as some beancounters in a company let you.

As End of Life Nears, More Than Half of Websites Still Use PHP V5

Found on Threatpost on Sunday, 21 October 2018
Browse Software

Despite end-of-life in the horizon, a new report by Web Technology Surveys found that PHP version 5 is still used by 61.8 percent of all server-side programming language websites. And, of those using version 5, 41.5 percent of websites are using version 5.6, the report said.

What this means is, security patches, upgrades and bug fixes will cease for end-of-life technology – putting that percentage of PHP-based websites using PHP 7.0 and below at risk.

With no doubt the writer of this article has not done any research at all and makes the same mistake as many so-called security analysists: blindly relying on version numbers. First of all, every admin should by default set expose_php to off to disable version information so it cannot be collected. That already messes up the numbers in the article. Even worse however is not knowing that the biggest player in the field of server operating systems, namely RedHat (and thus all others based on it, like CentOS), actively supports older PHP versions by backporting security patches. So, as long as admins keep their OS updated, bugs will be squashed, no matter if PHP itself has dropped support or not. Not knowing that should be embarrasssing to anybody who talks about webserver security. So in short, the article is completely misleading and entirely useless without taking the underlying server OS into the count.

Vivaldi 2.0 review: The modern Web browser does not have to be so bland

Found on Ars Technica on Saturday, 20 October 2018
Browse Software

Vivaldi has recently hit the 2.0 milestone. You can download the latest version from the Vivaldi site or install it through the app store or package manager of your OS. And at first blush, perhaps the most shocking thing about this release is that it's merely 2.0. This release is a throwback to an earlier time when version numbers had meaning, and a major number increment meant that something major had happened.

The most important thing for browser is that it actively protects the privacy of the user by all means possible to break tracking and data collection.

Firefox removes core product support for RSS/Atom feeds

Found on Gijsk on Friday, 12 October 2018
Browse Software

After considering the maintenance, performance and security costs of the feed preview and subscription features in Firefox, we’ve concluded that it is no longer sustainable to keep feed support in the core of the product. While we still believe in RSS and support the goals of open, interoperable formats on the Web, we strongly believe that the best way to meet the needs of RSS and its users is via WebExtensions.

Likewise, the feed viewer has its own “special” XML parser, distinct from the main Firefox one, and has not had a significant update in styling or functionality in the last seven years.

Styling RSS feeds? What for? To stuff annoying advertising and tracking into the textblocks? Maintaining your own "special" XML parser is like maintaining your own "special" encryption: in other words, pretty much a really bad idea.

Microsoft Windows 10 October update giving HP users BSOD

Found on The Register on Thursday, 11 October 2018
Browse Software

Microsoft on Tuesday posted KB4464330 (Windows 10 1809 Build 17763.55) in an effort to halt the damage done by last week's Windows 10 version 1809 update, but it hasn't quite worked.

"After doing updates, this machine blue screens with the error message WDF_VIOLATION," wrote an individual identified as "PhilBJSPC." "I cannot boot to safe mode and it does not allow me to do a system restore before the updates have gone through. …"

"This is why auto-installed updates are so dangerous," observed Steve Bellovin, a professor in the computer science department at Columbia University, via Twitter.

So to sum it up, this autoupdate messes up when Intel audio is present, deletes userdata and bluescreens on HP and DELL machines? Is Microsoft testing at all? These are not rare edge cases with obscure hardware.

Windows 10 October 2018 Update is deleting user data — here's how to protect yourself

Found on Windows Central on Saturday, 06 October 2018
Browse Software

Shortly after the new version became available as a manual download (using the Media Creation Tool, Update Assistant, and Windows Update) several users started reporting that the upgrade process is wiping out their documents, pictures, and other personal files along with previously installed programs.

If your device still hasn't received the new version, remember that you can delay the upgrade until you know for sure that data loss and other problems have been resolved.

Well that didn't take long for Microsoft to mess up even more. The problems with Intel's audio were annoying, but this one is a total roadblock that should have halted the rollout during the QC process. Funny is how MS fanboys just point at creating full backups (and of course backups are always a very good idea which should be done regularly).