Open Source

Software Freedom Conservancy Wins Big Step Forward For Open-Source Rights (zdnet.com) 18

An anonymous reader quotes a report from ZDNet: The Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), recently sued major TV vendor Vizio for abusing the GPL with its Linux-based SmartCast OS. Vizio replied that the SFC had no right to ask for the source code. On May 13, however, the SFC succeeded in federal court with its motion to have its lawsuit against Vizio remanded back to Superior Court in Orange County, CA.

Doesn't sound like that big a deal? Think again. The important part of the decision by U.S. District Court Judge Josephine L. Staton stated that SFC's claim "that the [GPLv2] enforcement of 'an additional contractual promise separate and distinct from any rights provided by the copyright laws' amounts to an 'extra element,' and therefore, SFC's claims are not preempted." Karen M. Sandler, SFC's executive director, explained, "The ruling is a watershed moment in the history of copyleft licensing. This ruling shows that the GPL agreements function both as copyright licenses and as a contractual agreement." Sandler added that even in the Free and Open Source Software (FOSS) legal community people argue incorrectly that the GPL and other copyleft licenses only function as copyright licenses. This decision clearly states that the GPL also acts as a contract. Further, this decision makes it the first case to show individual consumers have rights to the source code as third-party beneficiaries of the GPL.

Linux

CentOS Successor Rocky Linux Gets $26M to Fund Push Into Enterprise Space (zdnet.com) 27

"CIQ has landed $26 million in funding to support its plans to expand the use of Rocky Linux in the enterprise space," reports ZDNet. Last year, Red Hat decided to stop supporting CentOS 8 and shifted focus to CentOS Stream. CentOS had some huge enterprise users, among them Disney, GoDaddy, RackSpace, Toyota, and Verizon. In response, Greg Kurtzer, one of CentOS's founders, kicked off Rocky Linux in December 2020.... Kurtzer says Rocky Linux adoption has been "massive", with monthly downloads of OS images typically 250,000, reaching 750,000 in a bumper month. "Within two months we had 10,000 developer and contributors trying to be part of this project...."

The project has gained the support of Greg Kroah-Hartman, the maintainer of the main-line stable Linux kernel, to meet community demands for Rocky Linux to run on a more modern, optimized kernel, Kurtzer said. Kroah-Hartman is leading Rocky Linux special interest group (SIG) for the kernel to create an optional enhanced kernel for Rocky Linux. "He's working closely with us to make sure the kernel we use is blessed by him. He's in the loop as bugs come up and help us manage that kernel in Rocky Linux," says Kurtzer.

"Moreover, today's news follows shortly after CIQ inked a major deal with Google to help support companies looking to deploy Rocky Linux on Google's cloud infrastructure," reports VentureBeat.

Kurtzer tells the site that Rocky Linux "has been a rocket ship in terms of uptake across the enterprise and cloud."
The Almighty Buck

Google Launches Google Wallet To Help You Store Your Credit Cards, Tickets and More (techcrunch.com) 32

At its I/O developer conference, Google today launched Google Wallet, a new Android and Wear OS app that will allow users to store things like credit cards, loyalty cards, digital IDs, transit passes, concert tickets, vaccination cards and more. TechCrunch reports: That's pretty straightforward, but from here on out, it gets a bit confusing. [...] [Back in 2018, Google Wallet was folded into Google Pay.] Currently, Google Pay is available in 42 markets, Google says. Because in 39 of those markets, Google Pay is still primarily a wallet, those users will simply see the Google Pay app update to the new Google Wallet app. But in the U.S. and Singapore, Google Pay will remain the payments-focused app while the Wallet app will exist in parallel to focus on storing your digital cards. Meanwhile, in India, Google says that "people will continue to use their Google Pay app they are familiar with today."

"The Google Pay app will be a companion app to the Wallet," said Arnold Goldberg, the VP and GM of Payments at Google, who joined the company earlier this year after a long stint at PayPal. "Think of [the Google Pay app] as this higher value app that will be a place for you to make payments and manage money, whereas the wallet will really be this container for you to store your payment assets and your non-payment assets." Goldberg noted that Google decided to go this route because of the rapid digitization we've been seeing during the last two years of the pandemic.

Google

Google Announces Its First Smartwatch, a New Budget Phone (cnbc.com) 29

Google announced several new gadgets during its I/O developer conference on Wednesday, including its long-awaited Pixel Watch, a new budget Pixel 6a phone and headphones. It also teased its flagship Pixel 7 phone, which is coming this fall. From a report: The Google Pixel Watch offers features similar to the Apple Watch's and sports a refined and sleek look that could appeal to customers who use Android instead of the iPhone, which it doesn't work with. It will integrate Fitbit's technology, allowing it to pull on years of research and development from the fitness startup it acquired last year. The Fitbit tech will let users track their sleep, heart rate and workouts. The watch runs Google's Wear OS software that lets users do things such as check messages and download music. Users can also get directions with Google Maps or connect it with their smart home devices, so they can, for example, change their thermostat temperature or make sure the lights are turned off.

Google will release its latest budget Pixel phone this summer. The Pixel 6a has mostly the same design as the Pixel 6, but will be slightly smaller and cost $449. Google promised an all-day battery that can last up to 72 hours when in the Extreme Battery Saver mode, which it said is a first for Pixel phones. It also uses Google Tensor, so the budget phone will have the same power as the more expensive Pixel 6 and Pixel 6 Pro. [...] Google teased the new Pixel 7 and Pixel 7 Pro flagship phones. They'll use the next generation of the Google Tensor chip and will ship with Android 13. The company didn't provide pricing, but the Pixel 6 had been targeted at the midrange market with a $599 starting price, while the 6 Pro started at $899.

Microsoft

Microsoft Recommends People Uninstall Optional Windows 11 Update KB5012643 (extremetech.com) 75

DrunkenTerror shares a report from ExtremeTech: Microsoft is advising Windows 11 users to uninstall a recent update. Reports indicated the optional update KB5012643 is causing various apps to crash. The problem involves an interaction between the update and the .Net Framework that's part of Windows. At this time it's unclear which apps are affected by the issue, leaving uninstallation as the "only" viable solution.

"Affected apps are using certain optional components in .NET Framework 3.5, such as Windows Communication Foundation (WCF) and Windows Workflow (WWF) components." This update also broke Safe Mode. Microsoft says when users booted into 'Safe Mode without networking' users might see the screen flicker. Per MS, "Components that rely on explorer.exe, such as File Explorer, the Start menu, and the taskbar, can be affected and appear unstable." Microsoft issued a Known Issue Rollback (KiR) for this already so it should be fixed. If you encounter it, you should be able to resolve it by enabling network support in Safe Mode.

Security

Hackers Are Now Hiding Malware In Windows Event Logs (bleepingcomputer.com) 49

Security researchers have noticed a malicious campaign that used Windows event logs to store malware, a technique that has not been previously documented publicly for attacks in the wild. BleepingComputer reports: The method enabled the threat actor behind the attack to plant fileless malware in the file system in an attack filled with techniques and modules designed to keep the activity as stealthy as possible. [...] The dropper copies the legitimate OS error handling file [...] and then drops an encrypted binary resource to the 'wer.dll' (Windows Error Reporting) in the same location, for DLL search order hijacking to load malicious code. DLL hijacking is a hacking technique that exploits legitimate programs with insufficient checks to load into memory a malicious Dynamic Link Library (DLL) from an arbitrary path.

[Denis Legezo, lead security researcher at Kaspersky] says that the dropper's purpose is to loader on the disk for the side-loading process and to look for particular records in the event logs (category 0x4142 - 'AB' in ASCII. If no such record is found, it writes 8KB chunks of encrypted shellcode, which are later combined to form the code for the next stager. "The dropped wer.dll is a loader and wouldn't do any harm without the shellcode hidden in Windows event logs," says Legezo. The new technique analyzed by Kaspersky is likely on its way to becoming more popular as Soumyadeep Basu, currently an intern for Mandiant's red team, has created and published on GitHub source code for injecting payloads into Windows event logs.

Open Source

(Mostly) Open Source SteamOS Forked into Homegrown ISO For Other Machines (neowin.net) 22

"While Valve has yet to actually release a proper ISO for SteamOS 3 used on the Steam Deck, others have been taking it into their own hands to provide," reports GamingOnLinux, "like with the new HoloISO.

"This is possible, since 99% of what SteamOS uses is open source (not the Steam client though)..." So people can easily hack away at it to do whatever they want. [HoloISO] is not exactly the same as SteamOS 3 but it's probably the closest I've seen yet, with the main packages coming direct from Valve with "zero possible edits" the developer says.
It's described as a "first beta release."

Neowin supplies some context: Back in early March, Valve released the Steam Deck recovery image for Deck users who need to get back to a factory state. When it was released, many of us over at the Steam OS subreddit did the first thing any reasonable enthusiast would do and tried installing it on a standard PC. The results of this approach were mixed, and only partial successes were achieved. Then HoloISO happened....

The first release, called 'Ground Zero', was released today and allows users to install Steam OS on any machine. But there are some things you need to know before installing this for yourself....

There's a bunch of caveats, but the article still concludes that "If you're team red and you want to give this a shot, head over to the project's Github page to read more and download."

Thanks to Slashdot reader segaboy81 for sharing the story!
IBM

IBM Finally Announces IBM I Version 7.5 (itjungle.com) 39

Long-time Slashdot reader slack_justyb writes: IBM announces IBM i (some you of you may know it under the old name of AS/400) 7.5 the first new release in three years since the 7.4 release. One of the big headlines with the IBM i 7.5 announcement is Merlin which stands for the Modernization Engine for Lifecycle Integration....

With the Db2 product, IBM i is now receiving Boolean data types with support for this new type in RPG and JSON environments. Larger Indexes, the previous limit was 1.6TB indexes, that has now been increased to 16TB. And Db2 is now fully compliant with SQL:2016 the most recent publication of the SQL standard, beating Oracle to the punch on full support of the standard. And finally, QSYS2-based functions for using HTTP requests to publish or consume Web services, including the use of embedded SQL in REST services. These are enhanced versions of the functions that were seen in 7.3/7.4 where IBM removed the requirement for a JVM to use SQL to consume web services.

IT Jungle has many more details. Some of the highlights: Merlin provides a lightweight, browser-based development environment for creating new applications or modernizing existing RPG-based application. It's an alternative to Rational Developer for i (RDi) based on Eclipse, which many developers seem to hate. Developed in partnership with ARCAD Software, Merlin comes pre-loaded with tools like Git and Jenkins for DevOps-style code management, as well as an RPG code-converter. It runs in a Linux-based Red Hat OpenShift container running on the Power platform. While it's not technically tied to IBM i version 7.5 or 7.4 TR6, Merlin represents an important change in how IBM is packaging and delivering capabilities for IBM i shops, as well as a recognition that IBM should take a more active role in helping users modernize their codebases....

IBM is now enabling customers to buy subscriptions to IBM i for periods of one to five years. Allowing customers to use operating expenditure (Opex) budget lines instead of the dreaded capital expenditure (CapEx) accounting code for subscriptions. IBM is focusing on lower-end IBM i environments at the moment, so the subscription is limited to four-core P05 machines at this time. As part of this shift to software subscriptions, IBM is rethinking how it bundles ancillary products that are often used with IBM i. 11 packages are being moved into the core OS entitlement.

Google

Apple, Google, and Microsoft Want To Kill the Password With 'Passkey' Standard (arstechnica.com) 195

Apple, Google, and Microsoft are launching a "joint effort" to kill the password. The major OS vendors want to "expand support for a common passwordless sign-in standard created by the FIDO Alliance and the World Wide Web Consortium." From a report: The standard is being called either a "multi-device FIDO credential" or just a "passkey." Instead of a long string of characters, this new scheme would have the app or website you're logging in to push a request to your phone for authentication. From there, you'd need to unlock the phone, authenticate with some kind of pin or biometric, and then you're on your way. This sounds like a familiar system for anyone with phone-based two-factor authentication set up, but this is a replacement for the password rather than an additional factor.

Some push 2FA systems work over the Internet, but this new FIDO scheme works over Bluetooth. As the whitepaper explains, "Bluetooth requires physical proximity, which means that we now have a phishing-resistant way to leverage the user's phone during authentication." Bluetooth has a terrible reputation for compatibility, and I'm not sure "security" has ever been a real concern, but the FIDO alliance notes that Bluetooth is just "to verify physical proximity" and that the actual sign-in process "does not depend on Bluetooth security properties." Of course, that means both devices will need Bluetooth on board, which is a given for most smartphones and laptops but could be a tough ask for older desktop PCs.

Ubuntu

This Week Saw New Releases of 'Ubuntu Unity' and 'Ubuntu Cinnamon' (theregister.com) 74

The Register noted this week that two "unofficial" Ubuntu remixes "came out on the same day as the official flavors."

- Ubuntu Cinnamon (Linux Mint's flagship desktop environment)

- Ubuntu Unity, a revival of what used to be the official Ubuntu desktop by Ubuntu team member Rudra B. Saraswat (described the Register as "a 12-year-old wunderkind") Ubuntu Cinnamon is the older of the two and first appeared in 2019, while Ubuntu Unity came out in May 2020, soon after the release of Ubuntu 20.04.

Ubuntu Unity....has the macOS-like desktop that was Ubuntu's standard offering from 2011 until the company pensioned it off in 2017.... Ubuntu Unity is as free as Ubuntu itself, and the new remix continues to evolve. In 22.04, most of the GNOME-based accessory apps have been replaced with the MATE equivalents, such as the Pluma text editor and Atril document viewer. (A handful remain, such as the GNOME system monitor rather than the MATE one, but the differences are trivial.) The System Settings app is the original Unity one, and the Unity Tweaks app comes pre-installed.... The new "Jammy Jellyfish" version of Ubuntu Unity also adds support for Flatpak packages alongside Ubuntu's native Snap packages. To do this, it replaces Ubuntu's Software Store with version 41.5 of GNOME Software. Interestingly, this also supports Snap packages, so sometimes, when you search for a package, you might get multiple results: one for the OS-native DEB package, possibly one for a Flatpak, and maybe a Snap version too....

[I]f you dislike both the Unity and GNOME desktops and want something more Windows-like, but you don't mind GNOME's CSD windows, then Joshua Peisach's Ubuntu Cinnamon remix may appeal. Cinnamon is the default desktop of both Ubuntu-based Linux Mint and its Debian variant. Ubuntu Cinnamon combines the latest upstream version of Mint's Cinnamon desktop, 5.2.7, with the standard app selection of upstream Ubuntu. This means most of its apps lack menu bars, except for the Nemo file manager and LibreOffice. For these classic-style apps, the Ubuntu Cinnamon distro has tweaked the GNOME title-bar layout to be more Windows-like: minimize/maximize/close buttons at top right, and a window-management menu at top left....

Cinnamon's roots as a fork of GNOME 3 do offer a significant potential feature that MATE, Xfce and indeed Unity cannot do: fractional scaling. This is clearly labelled as an experimental feature, and in testing, we couldn't get it to work, so for now, this remains a theoretical advantage.... These caveats aside, though, Ubuntu Cinnamon is maturing nicely in the new version. While Ubuntu and Ubuntu Unity are now purple-toned, Ubuntu Cinnamon has switched to a restrained theme in shades of dark orange and brown, which reminded us of the tasteful earth-toned Ubuntu of the old GNOME 2 days...

Both these desktops are X.11-based, so there's not a trace of Wayland in either distro. Both also benefit from having working 3D acceleration.

Both remixes "are aiming for inclusion as official Ubuntu flavors," the article points out.

But then again, "There are dozens of Ubuntu remixes and flavors out there. The official Ubuntu Derivatives page links to 30, and DistroWatch has more than five times as many, including many which are no longer maintained."
Open Source

Fedora's Lead Speaks on the Popularity of Linux and the Importance of Open Source (techrepublic.com) 68

Fedora project leader Matthew Miller spoke to TechRepublic's Jack Wallen this week, sharing some thoughts on the future of Linux — and on open source in general: Matthew Miller: I think it's a lost cause to try to "sell" our quirky technology interest to people who don't see it already. We need to take a different approach.... I think our message, at its root, has to be around open source.... [W]ith Linux, when you install an open-source distro, you're not just part of a fan community. You're part of a colossal, global effort that makes software more available to everyone, makes that software better and better, and makes the whole world better through sharing... Just by using it you're sharing in this amazing undertaking, part of a move away from scarcity to an economy based on abundance....

Jack Wallen: What's the biggest difference in Linux today vs. Linux of 10 years ago?

Matthew Miller: I think first we have to start with just the amazing ubiquity of it. Ten years ago, it was cute to find a TV that ran Linux. Now, not only is it definitely powering your TV, you've probably got Linux running on your lightbulbs! It's everywhere. And while Linux had pushed proprietary Unix from the server room, ten years ago Windows-based servers were pushing back. The cloud changed that — now, the cloud is Linux, almost completely. (Anything that isn't is a legacy app that it was too much trouble to port!) From tiny devices to the most powerful mainframes and supercomputers: Linux, Linux, Linux....

Jack Wallen: If Linux has an Achilles' heel, what is it?

Matthew Miller: Linux and the whole free and open-source software movement grew up with the rise of the internet as an open communication platform. We absolutely need that to continue in order to realize our vision, and I don't think we can take it for granted.

That's more general than an Achilles' heel, though, so right now let me highlight one thing that I think is troubling: Chrome becoming the dominant browser to the point where it's often the only way to make sites work. Chromium (the associated upstream project) is open source, but isn't really run as a community project, and, pointedly, very very few people run Chromium itself. I'd love to see that change, but I'd also like to see Firefox regain a meaningful presence.

Miller also said Fedora's next release is focused on simplicity. ("When the OS gets in the way, it drops from the conversation I want to have about big ideas to ... well, the boring technical details that people never want to deal with")

And he also shared his thoughts on what Linux needs most. "What I'd really like to see more of are more non-technical contributors. I mean, yes, we can always benefit from more packagers and coders and engineers, but I think what we really need desperately are writers, designers, artists, videographers, communicators, organizers and planners. I don't think big companies are likely to provide those things, at least, not for the parts of the Linux world which aren't their products."

"We need people who think the whole grand project I've been talking about is important, and who have the skills and interests to help make it real."
Android

Alibaba Cloud Gets More of Android Working On RISC-V Silicon (theregister.com) 28

An anonymous reader quotes a report from The Register: Alibaba Cloud has advanced its work to port Android to the RISC-V architecture. The Chinese cloud giant has spent more than a year working on a port of the Google-spawned OS and in January 2021 showed off a GUI powered by Android 10 running on silicon designed by T-Head Semiconductor -- an Alibaba subsidiary that designs its own RISC-V chip. Alibaba Cloud has now revealed it's working on Android 12, and has integrated third-party vendor modules. The result is Android on RISC-V that's capable of playing audio and video, running Wi-Fi and Bluetooth radios, and driving cameras.

The company has also "enabled more system enhancement features such as core tool sets, third-party libraries and SoC board support package on RISC-V," which collectively make RISC-V a better target for Android. Another advance is successful trials of TensorFlow Lite models on RISC-V. That effort means Android on RISC-V should be capable running workloads like image and audio classification and Optical Character Recognition. Alibaba Cloud hasn't detailed whether its porting efforts are directed to any particular processor, but is keen to point out that its homegrown Xuantie C906 processor recently aced the MLPerf Tiny v0.7 benchmark -- a test applied to Internet of Things devices. The company has also pointed out that its home-grown RISC-V kit has already been employed in smart home appliances, automotive applications, and edge computing. [...] The Xuantie C906 uses Alibaba-designed cores that are -- as required for RISC-V users -- available on GitHub.
When the firm has a complete version of Android on RISC-V, it "will be an important step towards China's goal of reducing its reliance on technology that other nations can control with restrictions such as trade bans," notes The Register. "As RISC-V is open source, preventing its flow to China is all but impossible."
Android

North Koreans Are Jailbreaking Phones To Access Forbidden Media (wired.com) 23

An anonymous reader quotes a report from Wired: For most of the world, the common practice of "rooting" or "jailbreaking" a phone allows the device's owner to install apps and software tweaks that break the restrictions of Apple's or Google's operating systems. For a growing number of North Koreans, on the other hand, the same form of hacking allows them to break out of a far more expansive system of control -- one that seeks to extend to every aspect of their lives and minds. On Wednesday, the North Korea-focused human rights organization Lumen and Martyn Williams, a researcher at the Stimson Center think tank's North Korea -- focused 38 North project, together released a report on the state of smartphones and telecommunications in the Democratic People's Republic of Korea, a country that restricts its citizens' access to information and the internet more tightly than any other in the world. The report details how millions of government-approved, Android-based smartphones now permeate North Korean society, though with digital restrictions that prevent their users from downloading any app or even any file not officially sanctioned by the state. But within that regime of digital repression, the report also offers a glimpse of an unlikely new group: North Korean jailbreakers capable of hacking those smartphones to secretly regain control of them and unlock a world of forbidden foreign content.

Learning anything about the details of subversive activity in North Korea -- digital or otherwise -- is notoriously difficult, given the Hermit Kingdom's nearly airtight information controls. Lumen's findings on North Korean jailbreaking are based on interviews with just two defectors from the country. But Williams says the two escapees both independently described hacking their phones and those of other North Koreans, roughly corroborating each others' telling. Other North Korea -- focused researchers who have interviewed defectors say they've heard similar stories. Both jailbreakers interviewed by Lumen and Williams said they hacked their phones -- government-approved, Chinese-made, midrange Android phones known as the Pyongyang 2423 and 2413 -- primarily so that they could use the devices to watch foreign media and install apps that weren't approved by the government. Their hacking was designed to circumvent a government-created version of Android on those phones, which has for years included a certificate system that requires any file downloaded to the device to be "signed" with a cryptographic signature from government authorities, or else it's immediately and automatically deleted. Both jailbreakers say they were able to remove that certificate authentication scheme from phones, allowing them to install forbidden apps, such as games, as well as foreign media like South Korean films, TV shows, and ebooks that North Koreans have sought to access for decades despite draconian government bans.

In another Orwellian measure, Pyongyang phones' government-created operating system takes screenshots of the device at random intervals, the two defectors say -- a surveillance feature designed to instill a sense that the user is always being monitored. The images from those screenshots are then kept in an inaccessible portion of the phone's storage, where they can't be viewed or deleted. Jailbreaking the phones also allowed the two defectors to access and wipe those surveillance screenshots, they say. The two hackers told Lumen they used their jailbreaking skills to remove restrictions from friends' phones, as well. They said they also knew of people who would jailbreak phones as a commercial service, though often for purposes that had less to do with information freedom than more mundane motives. Some users wanted to install a certain screensaver on their phone, for instance, or wipe the phone's surveillance screenshots merely to free up storage before selling the phone secondhand.
As for how the jailbreaking was done, the report says both jailbreakers "described attaching phones to a Windows PC via a USB cable to install a jailbreaking tool."

"One mentioned that the Pyongyang 2423's software included a vulnerability that allowed programs to be installed in a hidden directory. The hacker says they exploited that quirk to install a jailbreaking program they'd downloaded while working abroad in China and then smuggled back into North Korea." The other hacker might've obtained his jailbreaking tool in a computer science group at Pyongyang's elite Kim Il Sung University where he attended.
Windows

Microsoft Fixes Point of Sale Bug That Delayed Windows 11 Startup For 40 Minutes (theregister.com) 46

"The Register reports Microsoft fixed a Point of Sale bug that delayed Windows 11 startup for 40 minutes," writes Slashdot reader ellithligraw. "So much for the express lane at check-out." From the report: A fresh Windows 11 patch slipped out overnight as an optional update, but contains an impressively long list of fixes for Microsoft's flagship operating system. One bug addressed in KB5012643 could leave Point of Sale terminals hanging for up to 40 minutes during startup. Microsoft stated, "We fixed an issue that delays OS startup by approximately 40 minutes." "Microsoft described the fixes as 'improvements' [and chose to highlight the fact that temperature would now be displayed on top of the weather icon on the taskbar]," added Slashdot reader ellithligraw. "[Y]eah, Windows 11 is great as a PoS."
Security

Microsoft Finds Linux Desktop Flaw That Gives Root To Untrusted Users (arstechnica.com) 75

An anonymous reader quotes a report from Ars Technica: Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights -- the latest elevation of privileges flaw to come to light in the open source OS. [...] Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root. [...] A hacker with minimal access to a vulnerable desktop can chain together exploits for these vulnerabilities that give full root access. [The step-by-step exploit flow can be found in the article. The researcher also was able to gain persistent root access using the exploit flow to create a backdoor.]

The proof-of-concept exploit works only when it can use the "org.freedesktop.network1" bus name. The researcher found several environments where this happens, including Linux Mint, in which the systemd-networkd by default doesn't own the org.freedodesktop.network1 bus name at boot. The researcher also found several processes that run as the systemd-network user, which is permitted to use the bus name required to run arbitrary code from world-writable locations. The vulnerable processes include several gpgv plugins, which are launched when apt-get installs or upgrades, and the Erlang Port Mapper Daemon, which allows running arbitrary code under some scenarios.
The vulnerability has been patched, although it's unclear which version of Linux the patch is in.
Android

Google Pixel Watch Leaks After Being Lost and Found At Restaurant (arstechnica.com) 25

Android Central was sent images of Google's upcoming Pixel Watch after it was reportedly left at a restaurant in the U.S. It's reminiscent of when an Apple iPhone 4 was lost and found at a bar in 2010. From the report: Android Central has reviewed the images of the watch that could be announced during Google I/O next month. It's possible that the watch itself could be released alongside the Pixel 7. The source, who we have left anonymous to protect their identity, said the watch, which could be "a testing model for the Internal Pixel team," was found at a restaurant. The source requested Android Central to not publish their name or the restaurant name, including location, in order to protect their job. After the reporting of this story, the source wrote a Reddit post about the alleged watch. The source indicated that the watch was left at the restaurant "for a few weeks expecting the people that left it to return, but that never happened."

The watch in our images looks almost identical to leaks of rumored rendered images. It has a minimalist design and follows what leaks have suggested a screen with hardly any bezels. The image also confirms one of the rumored colors that the watch will come in: black. Previous rumors have suggested the watch will have a rotating crown and potentially two hidden buttons. It is a bit hard to tell from the image above, but if this is the rumored watch then there is definitely at least one button next to the crown.

[I]t seems that the watch's band is a proprietary Google band and looks very similar to the jelly-like Apple Watch sport bands. This could mean that we might see many more colors to come. It also looks like it attaches directly to the watch case. This might make swapping out watch bands difficult, especially when most of the other top Android smartwatches give you more leeway with standard watch band types. No charger was left behind with the watch, but it is possible that the watch could be charged from the back of the watch case. This is also how Fitbit's Versa 3 and Sense smartwatches (Fitbit is owned by Google) and the Apple Watch are charged. The source indicated that the bottom "looks metallic but feels like it's coated with glass." [...] The source indicated that nothing happened past the boot logo when they tried to power it up [...]. This likely means that there is no OS yet installed on the watch.

Unix

OpenBSD 7.1 Released with Support for Apple M1, Improvements for ARM64 and RISC-V (openbsd.org) 26

"Everyone's favorite security focused operating system, OpenBSD 7.1 has been released for a number of architectures," writes long-time Slashdot reader ArchieBunker, "including Apple M1 chips."

Phoronix calls it "the newest version of this popular, security-minded BSD operating system." With OpenBSD 7.1, the Apple Silicon support is now considered "ready for general use" with keypad/touchpad support for M1 laptops, a power management controller driver added, I2C and SPI controller drivers, and a variety of other driver additions for supporting the Apple Silicon hardware.

OpenBSD 7.1 also has a number of other improvements benefiting the 64-bit ARM (ARM64) and RISC-V architectures. OpenBSD 7.1 also brings SMP kernel improvements, support for futexes with shared anonymous memory, and more. On the graphics front there is updating the Linux DRM code against the state found in Linux 5.15.26 as well as now enabling Intel Elkhart Lake / Jasper Lake / Rocket Lake support.

The Register notes OpenBSD now "supports a surprisingly wide range of hardware: x86-32, x86-64, ARM7, Arm64, DEC Alpha, HP PA-RISC, Hitachi SH4, Motorola 88000, MIPS64, SPARC64, RISC-V 64, and both Apple PowerPC and IBM POWER." The Register's FOSS desk ran up a copy in VirtualBox, and we were honestly surprised how quick and easy it was. By saying "yes" to everything, it automatically partitioned the VM's disk into a rather complex array of nine slices, installed the OS, a boot loader, an X server and display manager, plus the FVWM window manager. After a reboot, we got a graphical login screen and then a rather late-1980s Motif-style desktop with an xterm.

It was easy to install XFCE, which let us set the screen resolution and other modern niceties, and there are also KDE, GNOME, and other pretty front-ends, plus plenty of familiar tools such as Mozilla apps, LibreOffice and so on....

We were expecting to have to do a lot more work. Yes, OpenBSD is a niche OS, but the project gave the world OpenSSH, LibreSSL, the PF firewall as used in macOS, much of Android's Bionic C library, and more besides.... In a world of multi-gigabyte OSes, it's quite refreshing. It felt like stepping back into the early 1990s, the era of Real Unix, when you had to put in some real effort and learn stuff in order to bend the OS to your will — but in return, you got something relatively bulletproof.

Android

Volla Phone 22 Runs Ubuntu Touch Or a Privacy-Focused Android Fork Or Both (liliputing.com) 22

The Volla Phone 22, a new smartphone available for preorder via a Kickstarter campaign, is unlike any other smartphone on the market today in that it ships with a choice of the Android-based Volla OS or the Ubuntu Touch mobile Linux distribution. "It also supports multi-boot functionality, allowing you to install more than one operating system and choose which to run at startup," writes Liliputing's Brad Linder. Some of the hardware specs include a 6.3-inch FHD+ display, a MediaTek Helio G85 processor, 4GB of RAM, 128GB storage, 3.5mm audio jack and a microSD card reader. There's also a 48-megapixel main camera sensor and replaceable 4,500mAh battery. From the report: While Volla works with the folks at UBPorts to ensure its phones are compatible with Ubuntu Touch, the company develops the Android-based Volla OS in-house. It's based on Google's Android Open Source Project code, but includes a custom launcher, user interface, and set of apps with an emphasis on privacy. The Google Play Store is not included, as this is a phone aimed at folks who want to minimize tracking from big tech companies. Other Google apps and services like the Chrome web browser, Google Maps, Google Drive, and Gmail are also omitted. The upshot is that no user data is collected or stored by Volla, Google, or other companies unless you decide to install apps that track your data. Of course, that could make using the phone a little less convenient if you've come to rely on those apps, so the Volla Phone might not be the best choice for everyone.

Volla OS also has a built-in user-customizable firewall, an App Locker feature for disabling and hiding apps, and optional support for using the Hide.me VPN for anonymous internet usage. The source code for Volla OS is also available for anyone that wants to inspect the code. The operating system also has a custom user interface including a Springboard that allows you to quickly launch frequently-used apps by pressing a red dot for a list, or by starting to type in a search box for automatic suggestions such as placing a phone call, sending a text message, or opening a web page. You can also create notes or calendar events from the Springboard or send an encrypted message with Signal.
The phone is expected to ship in June at an early bird price of about $408.
Android

The Nord N20 Is OnePlus' Budget Offering For 2022 (androidpolice.com) 12

For 2022, OnePlus has announced the Nord N20 5G as its budget offering for the US and Canadian markets, free when you add a line or $282. Android Police reports: Compared to the previous models, this year's phone sure seems to be a mid-range device rather than a budget one. The phone features a 6.43-inch AMOLED display with an in-display fingerprint scanner, a Snapdragon 695 chip, 6GB RAM, and 128GB storage. There's a microSD card slot, too, so you can expand the storage by up to 512GB if needed. A 4,500mAh battery powers the device, coming with 33W fast charging support that's enough to top up the cell to 50% in just 30 minutes. The phone's rear houses a triple-camera setup consisting of a 64MP primary sensor, a 2MP macro, and a monochrome lens -- there's no ultra-wide sensor here.

Judging from the specs, it is clear that the Nord N20 is a sister variant of the Nord CE 2 Lite with some minor downgrades. The latter is due to launch in India later this month. The Nord N20 runs the Android 11-based OxygenOS 11 and not Android 12. There's no word on when an update to Android 12 will arrive, either. Previous Nord phones in the US received only one OS update, so it is possible Android 12 could be the first and last OS update for the N20.

Windows

Is Windows 11 Less Popular Than Windows XP? (pcmag.com) 133

"A new survey claims Windows 11 adoption is so low it's actually less popular than the 20-year-old Windows XP," reports PC Magazine: The survey comes from an IT management provider called Lansweeper. Through its own software products, the company scanned 10 million Windows devices this month to determine which OS they were using. The results found that only 1.44% of the devices had Windows 11 installed, which is lower than the 1.71% for Windows XP. In contrast, Windows 10 maintains a dominant share at 80.34%. Although Windows 11's adoption is low at 1.44%, the number actually went up almost three times from 0.52% back in January.

It's also important to note that other surveys have found much higher Windows 11 adoption numbers. Last month, the app advertising platform AdDuplex found Windows 11 usage was at 19.4%, although this represented a mere 0.1% growth from the previous month. Meanwhile, the Steam hardware survey from Valve estimates Windows 11 usage has reached 16.8%.

Slashdot Top Deals