SparkyLinux 2021.03 "LXQt" overview | powered by debian
Posted: 2021-03-15 15:43:21 Source: https://www.youtube.com/watch?v=awUSQbL5Hkw
How to move from Ops to DevOps, Step by Step
Posted: 2021-03-15 01:42:36 Source: https://www.youtube.com/watch?v=1_OqSMv20Mo
Three Flaws in the Linux Kernel Since 2006 Could Grant Root Privileges
Posted: 2021-03-13 16:34:00 Source: http://rss.slashdot.org/~r/Slashdot/slashdotLinuxatom/~3/p5C0Bp9RLyQ/three-flaws-in-the-linux-kernel-since-2006-could-grant-root-privileges
"Three recently unearthed vulnerabilities in the Linux kernel, located in the iSCSI module used for accessing shared data storage facilities, could allow root privileges to anyone with a user account," reports SC Media: "If you already had execution on a box, either because you have a user account on the machine, or you've compromised some service that doesn't have repaired permissions, you can do whatever you want basically," said Adam Nichols, principal of the Software Security practice at GRIMM. While the vulnerabilities "are in code that is not remotely accessible, so this isn't like a remote exploit," said Nichols, they are still troublesome. They take "any existing threat that might be there. It just makes it that much worse," he explained. "And if you have users on the system that you don't really trust with root access it, it breaks them as well." Referring to the theory that 'many eyes make all bugs shallow,' Linux code "is not getting many eyes or the eyes are looking at it and saying that seems fine," said Nichols. "But, [the bugs] have been in there since the code was first written, and they haven't really changed over the last 15 years...." That the flaws slipped detection for so long has a lot to do with the sprawl of the the Linux kernel. It "has gotten so big" and "there's so much code there," said Nichols. "The real strategy is make sure you're loading as little code as possible." The bugs are in all Linux distributions, Nichols said, although the kernel driver is not loaded by default. Whether a normal user can load the vulnerable kernel module varies. They can, for instance, on all Red Hat based distros that GRIMM tested, he said. "Even though it's not loaded by default, you can get it loaded and then of course you can exploit it without any trouble...." The bugs have been patched in the following kernel releases: 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260, and 4.4.260. All older kernels are end-of- life and will not receive patches.
Read more of this story at Slashdot.
How to install KDE NEON 20210304
Posted: 2021-03-13 12:30:01 Source: https://www.youtube.com/watch?v=Eh22COwM1mU
7-Zip Developer Releases the First Official Linux Version
Posted: 2021-03-12 22:20:00 Source: http://rss.slashdot.org/~r/Slashdot/slashdotLinuxatom/~3/HrR2_GcunRc/7-zip-developer-releases-the-first-official-linux-version
An official version of the popular 7-zip archiving program has been released for Linux for the first time. Bleeping Computer reports: Linux already had support for the 7-zip archive file format through a POSIX port called p7zip but it was maintained by a different developer. As the p7zip developer has not maintained their project for 4-5 years, 7-Zip developer Igor Pavlov decided to create a new official Linux version based on the latest 7-Zip source code. Pavlov has released 7-Zip for Linux in AMD64, ARM64, x86, and armhf versions, which users can download [via their respective links]. "These new 7-Zip binaries for Linux were linked (compiled) by GCC without -static switch. And compiled 32-bit executables (x86 and armhf) didn't work on some arm64 and amd64 systems, probably because of missing of some required .so files." "Please write here, if you have some advices how to compile and link binaries that will work in most Linux systems," Pavlov stated on his release page.
Read more of this story at Slashdot.
End of Life Distributions: Setting up Extended Lifecycle Support to keep them patched
Posted: 2021-03-12 17:15:01 Source: https://www.youtube.com/watch?v=CLkGQNxVkS0
Solus 4.2 Overview Promo #Shorts
Posted: 2021-03-12 15:01:51 Source: https://www.youtube.com/watch?v=Hk98qOwdovI
System76 Releases New Thelio Desktop
Posted: 2021-03-11 15:37:41 Source: http://www.linux-magazine.com/Online/News/System76-Releases-New-Thelio-Desktop
One of the most ardent supporters of open source hardware has released a new desktop machine for home or office.
Networking with ZeroTier: Creating software-defined networks with Ease
Posted: 2021-03-11 14:00:02 Source: https://www.youtube.com/watch?v=9GTXN0opsdw
KDE NEON 20210304 overview | The latest and greatest of KDE community
Posted: 2021-03-10 17:08:03 Source: https://www.youtube.com/watch?v=4bMmQQ0iS4s
Linux Foundation Debuts Sigstore Project for Software Signing
Posted: 2021-03-10 14:45:00 Source: http://rss.slashdot.org/~r/Slashdot/slashdotLinuxatom/~3/39Dq44KCnzo/linux-foundation-debuts-sigstore-project-for-software-signing
The Linux Foundation has announced the launch of Sigstore, a new nonprofit initiative that aims to improve open source software supply chain security by making it easier for developers to adopt cryptographic signing for different components of the software development process. From a report: Sigstore will be free for software providers and developers, who can use it to securely sign software artifacts such as release files, container images, binaries, and bill-of-material manifests. Signing materials are then stored in a tamper-proof public log. The service's code and operation tooling will be fully open source and maintained and developed by the Sigstore community. Founding members include Red Hat, Google, and Purdue University. The idea for the service came from Luke Hinds, security engineering lead in Red Hat's Office of the CTO. He pitched the concept to Google software engineer Dan Lorenc, and the two began to work on it. Now the Sigstore project has a "small but agile community" working on its development, Lorenc says.
Read more of this story at Slashdot.
FSF’s LibrePlanet 2021 Free Software Conference Is Next Weekend, Online Only
Posted: 2021-03-09 17:00:00 Source: https://www.linuxjournal.com/content/fsfs-libreplanet-2021-free-software-conference-weekend-online-only
On Saturday and Sunday, March 20th and 21st, 2021, free software supporters from all over the world will log in to share knowledge and experiences, and to socialize with others within the free software community. This year’s theme is “Empowering Users,” and keynotes will be Julia Reda, Nathan Freitas, and Nadya Peek. Free Software Foundation (FSF) associate members and students attend gratis at the Supporter level.
You can see the schedule and learn more about the conference at https://libreplanet.org/2021/, and participants are encouraged to register in advance at https://u.fsf.org/lp21-sp.
The conference will also include workshops, community-submitted five-minute Lightning Talks, Birds of a Feather (BoF) sessions, and an interactive “exhibitor hall” and “hallway” for socializing.
Linux Essentials: Navigating the Linux Filesystem
Posted: 2021-03-09 14:30:00 Source: https://www.youtube.com/watch?v=BNL3qBN9pP0
Sunday Morning Linux Review - Episode 326 (Audio-Only)
Posted: 2021-03-08 22:00:22 Source: https://www.youtube.com/watch?v=fNeJEYo_wLE
NomadBSD 1.4 overview | A persistent live system for your USB flash drive
Posted: 2021-03-08 18:18:37 Source: https://www.youtube.com/watch?v=jG6I5hEj2N4
Quick Unboxing of my new Thelio Major
Posted: 2021-03-08 13:00:17 Source: https://www.youtube.com/watch?v=yHa5Vp9Ixjk
Why I Moved From Ops to DevOps (and why you might want to)
Posted: 2021-03-07 23:09:35 Source: https://www.youtube.com/watch?v=pQgHbHJlAjo
A Retired Microsoft OS Engineer's Comparison of Linux with Windows
Posted: 2021-03-07 20:34:00 Source: http://rss.slashdot.org/~r/Slashdot/slashdotLinuxatom/~3/XxSxlUNtA4c/a-retired-microsoft-os-engineers-comparison-of-linux-with-windows
David Plummer is a retired Microsoft operating systems engineer, "going back to the MS-DOS and Windows 95 days." (He adds that in the early '90s he'd fixed a few handle leaks in the early source code of Linux, "and sent my changes off to Linus at Rutgers.") This weekend on YouTube he shared his thoughts on "the classic confrontation: Windows versus Linux," promising an "epic operating systems face-off." Some highlights: On Usability: "Linux's itself lacks a proper user interface beyond the command line. That command line can be incredibly powerful, particularly if you're adept with Bash or Zsh or similar, but you can't really describe it as particularly usable. Of course most distributions do come with a desktop user interface of some kind if you prefer, but as a bit of a shell designer myself, if I might be so bold, they're generally pretty terrible. At least the Mint distribution looks pretty nice. "Windows, on the other hand, includes by default a desktop shell interface that, if you set aside the entirely subjective design aesthetics, is professionally designed, usability tested and takes into consideration the varying levels of accessibility required by people with different limitations. In terms of usability, particularly if you do include accessibility in that metric, Windows comes out ahead..." On Updates: "Windows users are well served by a dedicated Windows Update team at Microsoft, but the process has occasionally had its hiccups and growing pains. It's very easy to update a Linux system, and while there's no professional team sitting by the big red phone ready to respond to Day Zero exploits, the updates do come out with reasonable alacrity, and in some cases you can even update the kernel without rebooting. "Keep in mind, however, that Linux is a monolithic kernel, which means that it's all one big happy kernel. Almost everything is in there. If they hadn't started to add that ability a few years back, you'd be rebooting for every driver install. The reality is that some parts of the Linux kernel are just going to require a reboot, just as some parts of the Windows system are going to as well. I think we can likely all agree, however, that Windows software is hardly selective about rebooting the system, and you're asked to do it far too often. "While we're on the topic of upgrades, we can't overlook the fact that upgrades are generally free in the Open Source world, unless you're using a pre-built distribution from a vendor. To it's credit, though, I don't remember the last time Microsoft actually charged for an operating system upgrade if you were just a normal end user or enthusiast. Still, this point goes to Linux." Plummer also says he agrees with the argument that open source software is more open to security exploits, "simply because, all else equal, it's easy to figure out where the bugs are to exploit in the first place," while proprietary software has professional test organizations hunting for bugs. "I think it's a bit of a fallacy to rely on the 'many eyeballs' approach..." Yet he still ultimately concludes Linux is more secure simply because the vast universe of Windows makes it a much more attractive target. Especially since most Windows users retain full administrator privileges...
Read more of this story at Slashdot.
What's the Best Linux Distro for Enhanced Privacy and Security?
Posted: 2021-03-07 08:34:00 Source: http://rss.slashdot.org/~r/Slashdot/slashdotLinuxatom/~3/kP-1Nm0x-5s/whats-the-best-linux-distro-for-enhanced-privacy-and-security
Slashdot reader b-dayyy quotes the Linux Security blog: While all Linux 'distros' — or distributed versions of Linux software — are secure by design, certain distros go above and beyond when it comes to protecting users' privacy and security. We've put together a list of our favorite specialized secure Linux distros and spoken with some of their lead developers to find out first-hand what makes these distros so great. This "favorites" list cites six "excellent specialized secure Linux distros." Some highlights from the article: In a conversation with the LinuxSecurity editors, Qubes OS Community Manager Andrew David Wong elaborated, "Rather than attempting to fix all of the security bugs in software, Qubes assumes that all software is buggy and compartmentalizes it accordingly, so that when flaws are inevitably exploited, the damage is contained and the user's most valuable data is protected." A Kali Linux contributor provides some insight into the distro's history and the benefits it offers users: "Named after a Hindu goddess, Kali has been around for a long time — but it's still updated weekly, can be run in live mode or installed to a drive, and can also be used on ARM devices like Raspberry Pi." Obviously there's strong opinions among Slashdot readers. So share your own thoughts in the comments. What's the best Linux distro for enhanced privacy and security?
Read more of this story at Slashdot.
Torvalds Warns the World: Don't Use the Linux 5.12-rc1 Kernel
Posted: 2021-03-06 22:34:00 Source: http://rss.slashdot.org/~r/Slashdot/slashdotLinuxatom/~3/8OjkVPtCx34/torvalds-warns-the-world-dont-use-the-linux-512-rc1-kernel
"In a message to the Linux Kernel Mailing List Wednesday, founding developer Linus Torvalds warned the world not to use the 5.12-rc1 kernel in his public git tree..." writes Ars Technica: As it turns out, when Linus Torvalds flags some code dontuse, he really means it — the problem with this 5.12 release candidate broke swapfile handling in a very unpleasant way. Specifically, the updated code would lose the proper offset pointing to the beginning of the swapfile. Again, in Torvalds' own words, "swapping still happened, but it happened to the wrong part of the filesystem, with the obvious catastrophic end results." If your imagination is insufficient, this means that when the kernel paged contents of memory out to disk, the data would land on random parts of the same disk and partition the swapfile lived on... not as files, mind you, but as garbage spewed directly to raw sectors on the disk. This means overwriting not only data in existing files, but also rather large chunks of metadata whose corruption would likely render the entire filesystem unmountable and unusable. Torvalds goes on to point out that if you aren't using swap at all, this problem wouldn't bite you. And if you're using swap partitions, rather than swap files, you'd be similarly unaffected... Torvalds also advised anyone who'd already pulled his git tree to do a git tag -d v5.12-rc1 "to actually get rid of the original tag name..." — or at least, to not use it for anything. "I want everybody to be aware..." Torvalds writes, "because _if_ it bites you, it bites you hard, and you can end up with a filesystem that is essentially overwritten by random swap data. This is what we in the industry call 'double ungood'."
Read more of this story at Slashdot.