Linux Journal

Chrome Browser Launching Mitigation for Spectre Attacks, The Linux Foundation Announces LF Energy Coalition, Kube 0.7.0 Now Available, New Android Apps for Nativ Vita Hi-Res Music Server and More

3 months ago

News briefs for July 13, 2018.

Google's Chrome browser is launching site isolation, "the most ambitious mitigation for Spectre attacks", Ars Technica reports. Site isolation "segregates code and data from each Internet domain into their own 'renderer processes', which are individual browser tasks that aren't allowed to interact with each other". This has been optional in Chrome for months, but starting with version 67, it will be enabled by default for 99% of users.

The Linux Foundation yesterday launched LF Energy, a new open-source coalition. According to the press release, LF Energy was formed "with support from RTE, Europe's biggest transmission power systems provider, and other organizations, to speed technological innovation and transform the energy mix across the world." Visit for more information.

Version 0.7.0 of Kube, the "modern communication and collaboration client", is now available. Improvements include "a conversation view that allows you to read through conversations in chronological order"; "a conversation list that bundles all messages of a conversation (thread) together"; "automatic attachment of own public key"; "the account setup can be fully scripted through the sinksh commandline interface"; and more. See for more info.

Nativ announced new iOS and Android apps for its Nativ Vita Hi-Res Music Server. The new apps, available from the Google Play Store, "give customers convenient control and playback functionality from their iOS or Android Smartphone or Tablet".

KDE released the third stability update for KDE Applications 18.04 yesterday. The release contains translation updates and bug fixes only, including improvements to Kontact, Ark, Cantor, Dolphin, Gwenview, KMag, among others. The full list of changes is available here.

NVIDIA announced its Jetson Xavier Developer Kit for the octa-core AI/robotics-focused Xavier module. According to Linux Gizmos, "the kit, which goes on sale for $1,300 in August, offers the first access to Xavier aside from the earlier Drive PX Pegasus autonomous car computer board, which incorporates up to 4x Xavier modules. The kit includes Xavier's Linux-based stack and Isaac SDK."

Mozilla announced the winners of 2018H1 Mozilla Research grants. Eight proposals were selected, "ranging from tools to fight online harassment to systems for generating speech. All these projects support Mozilla's mission to make the Internet safer, more empowering, and more accessible." See the Research Grants page for more info on the grants and how to apply.

News Chrome Spectre Google Security Browsers The Linux Foundation open source KDE Desktop Collaboration multimedia Android NVIDIA Mozilla
Jill Franklin

Empowering Linux Developers for the New Wave of Innovation

3 months ago
by Evan Dandrea

New businesses with software at their core are being created every day. Developers are the lifeblood of so much of what is being built and of technological innovation, and they are ever more vital to operations across the entire business. So why wouldn't we empower them?

Machine learning and IoT in particular offer huge opportunities for developers, especially those facing the crowded markets of other platforms, to engage with a sizeable untapped audience.

That Linux is open source makes it an amazing breeding ground for innovation. Developers aren’t constrained by closed ecosystems, meaning that Linux has long been the operating system of choice for developers. So by engaging with Linux, businesses can attract the best available developer skills. 

The Linux ecosystem has always strived for a high degree of quality. Historically it was the Linux community taking sole responsibility for packaging software, gating each application update with careful review to ensure it worked as advertised on each distribution of Linux. This proved difficult for all sides.

Broad access to the code was needed, and open-source software could be offered through the app store. User support requests and bugs were channelled through the Linux distributions, and there was such a volume of reporting, it became difficult to feed information back to the appropriate software authors.

As the number of applications and Linux distributions grew, it became increasingly clear this model would not scale much further. Software authors took matters into their own hands, often picking a single Linux distribution to support and skipping the app store entirely. Because of this, they lost app discoverability and gained the complexity of running duplicative infrastructure.

This placed increased responsibility on developers at a time when the expectations of their role was already expanding. They are no longer just makers, they now bear the risk of breaking robotic arms with their code or bringing down MRI machines with a patch.

As an industry we acknowledge this problem—you can potentially have a bad update and software isn’t an exact science—but we then ask these developers to roll the dice. Do you risk compromise or self-inflicted harm?

Meanwhile the surface area increases. The industry continues a steady march of automation, creating ever more software components to plug together and layer solutions on. Not only do developers face the update question for their own code, they also must trust all developers facing that same decision in all the code beneath their own.

Go to Full Article
Evan Dandrea

Guido van Rossum Stepping Down from Role as Python's Benevolent Dictator For Life

3 months ago

Python's Benevolent Dictator For Life (BDFL) Guido van Rossum today announced he's stepping down from the role.

On the Python mailing list today, van Rossum said, "I would like to remove myself entirely from the decision process. I'll still be there for a while as an ordinary core dev, and I'll still be available to mentor people—possibly more available. But I'm basically giving myself a permanent vacation from being BDFL, and you all will be on your own."

He credits his decision to step down as partly due to his experience with the turmoil over PEP 572: "Now that PEP 572 is done, I don't ever want to have to fight so hard for a PEP and find that so many people despise my decisions."

van Rossum says he will not appoint a successor and leave that to the development team to decide upon.

For old-time's sake, see Linux Journal's interview with Guido van Rossum from 1998.

News python Guido van Rossum
Carlie Fairchild

freenode Launches New Job Board, Two More Spectre Security Holes Discovered, Debian Joins KDE's Advisory Board, Android Malware Found in the Google Play Store and Stable Kernels Released

3 months ago

News briefs for July 12, 2018.

freenode has a new job board. "aims to connect those looking to hire with the immense talent that can be found within the wider freenode communities". The job board is free to use, but companies that use it successfully are encouraged to make a donation to help support the freenode network, and the annual freenode #live conference.

Two new Spectre-type security holes have been discovered. ZDNet reports that this affects any operating system running on AMD, ARM and Intel processors. Vladimir Kiriansky, PhD candidate at MIT, and independent researcher Carl Waldspurger found the new vulnerabilities and published a paper. ZDNet also notes that so far, no known attacks have occurred making use of these bugs, but that likely will change soon.

Debian has joined KDE's advisory board. Chris Lamb, Debian Project Leader, commented that "The KDE Plasma desktop environment is fully-supported within Debian and thus the Debian Project is extremely excited to be formally recognising the relationship between itself and KDE, especially how that will greatlyincrease and facilitate our communication and collaboration."

Yesterday Greg Kroah-Hartman released stable kernels 4.17.6, 4.14.55, 4.9.112, 4.4.140 and 3.18.115. Users should update right away. (Source:

Android malware called Anubis has been found the Google Play Store. According to ZDNet, "a cyber crime group has sneaked apps onto the official Google Play Store which then serve up Trojan banking malware to Android users". In addition, "developers of the malware are regularly altering the capabilities of the malware and will slightly alter the code to ensure that it isn't detected by Google Play's security controls".

freenode jobs Spectre Security Intel AMD ARM Debian KDE kernel Android Mobile
Jill Franklin

Road to RHCA--Preparation Meets Opportunity

3 months ago
by Taz Brown

This article is the second in my series "Road to RHCA", where I'm charting my journey to the Red Hat Certified Architect designation—a designation that's difficult to come by. As an advocate and enthusiast of Linux and open source, and more important, as someone who works as a Linux professional, I am eager to change the current state of affairs around the number of women and people of color who know Linux and open source, study Linux and work in the Linux and/or open-source space.

Things haven't changed much in general when it comes to the numbers of women and people of color who enter the IT field, but those numbers drop significantly when it comes to Linux and open source. It's my goal to convince other women and people of color to study Linux and pursue open-source projects, because diversity of thought is invaluable in the world and in the enterprise. This world is not homogeneous; nothing else ever should be either. So I'd like to see more professionals who look like me in Linux and the Open Source community, and I'm starting to see a few, but there's still more work to be done.

Joining the RHCA ranks requires significant time and effort. Nothing worth anything comes easy, nor should it, but I can say with work, family, mentoring and now writing a book for Packt publishing, finding time to study will be more and more difficult for me, but it's my highest priority. At the time of this writing, I am five exams away.

You can choose from five areas of concentration, or you can select any combination of eligible Red Hat certifications to create a custom concentration. Those five concentrations are:

  • Data Center
  • DevOps
  • Application Platform
  • Cloud
  • Application Development

I decided the best route to my RHCA is for me to customize my concentration to include these five certifications in the order I plan to take them:

  1. Red Hat-Certified Specialist in Ansible Automation
  2. Red Hat-Certified Specialist in High Availability Clustering
  3. Red Hat-Certified Specialist in Red Hat OpenStack
  4. Red Hat-Certified Specialist in Linux Diagnostics and Troubleshooting
  5. Red Hat-Certified Specialist in OpenShift Administration

If you ask Red Hat the company, it obviously would recommend paying for and using one of its subscription options. The standard option costs $5,500, and the basic option costs $7,000. Having the subscription definitely would be beneficial, especially if you are working toward an RHCA, but it's not something that everyone can afford. You might be able to get your employer to cover the costs, but that's not always possible. So how does one without such resources become an RHCA? True grit, determination and a little creativity.

Go to Full Article
Taz Brown

Cooking with Linux (without a Net): Remote Linux System Administration Using Webmin and Virtualmin

3 months 1 week ago

Please support Linux Journal by subscribing or becoming a patron.

It's time for the "Cooking with Linux (without a Net)" show where I do cool Linux and open-source stuff, live, on camera, and without the benefit of post video editing, therefore providing a high probability of falling flat on my face. On today's show, we cover remote Linux system administration using Webmin, a web-based, do-it-all admin tool. As a bonus, we explore Virtualmin, a Webmin extension that can turn you into an ISP by making it easy to manage accounts, multiple users, domains, permissions and everything else you need. It's a completely free alternative to pricey products like cPanel. Finally, I take a shot at yet another never-before-tried Linux distribution: Trinity PCLinuxOS. Also, in case you don't already know, this is a prerecorded show of a live YouTube broadcast.

Show links:

Cooking with Linux SysAdmin video
Marcel Gagné

Xen Hypervisor 4.11 Released, New Browsh Text-Based Browser, Finney Cryptocurrency Phone, GNOME Hiring and More

3 months 1 week ago

News briefs for July 11, 2018.

The Xen Hypervisor 4.11 was released yesterday. In this release "PVH Dom0 support is now available as experimental feature and support for running unmodified PV guests in a PVH Container has been added. In addition, significant chunks of the ARM port have been rewritten." Xen 4.11 also contains mitigations for Meltdown and Spectre vulnerabilities. For detailed download and build instructions, go here.

There's a new text-based browser called Browsh, Phoronix reports. Browsh can render anything a modern browser can, and you can use it from a terminal or within a normal browser to reduce bandwidth and increase browser speed. For more info and to download, see the Browsh project website.

Facebook to be fined the maximum (500k euros), and the UK's privacy watchdog, the Information Commissioner's Office (ICO), has published a report called "Democracy Disrupted? Personal information and political influence" that outlines policy recommendations for how personal information is used in connection with political campaigns. According to the TechCrunch article, the report "calls directly for an 'ethical pause' around the use of microtargeting ad tools for political campaigning" and specifically "flags a number of specific concerns attached to Facebook's platform and its impact upon people's rights and democratic processes..."

Sirin Labs to launch the $1,000 Finney cryptocurrency smartphone this fall, Engadget reports. The Finney (named after Bitcoin pioneer Hal Finney) is a "state of the art mobile device for the blockchain era" and runs on a forked version of Android. It has a slider on the back where "you'll find a secondary display, called the Safe Screen, that's only used for crypto transactions....The slider also activates the cold storage wallet that is designed to hold a significant number of different cryptocurrencies."

The GNOME Foundation is hiring. After receiving a generous grant in May of this year, The Foundation is recruiting for four posts: Development Coordinator, Program Coordinator, Devops/Sysadmin and GTK+ Core Developer. See the Positions available page for information on how to apply.

News xen Hypervisor Browsers smartphones Cryptocurrency Android Blockchain GNOME Privacy Facebook
Jill Franklin

Minimum GCC Version Likely to Jump from 3.2 to 4.8

3 months 1 week ago
by Zack Brown

The question of the earliest GCC compiler version to support for building the Linux kernel comes up periodically. The ideal would be for Linux to compile under all GCC versions, because you never know what kind of system someone is running. Maybe their company's security team has to approve all software upgrades for their highly sensitive devices, and GCC is low on that list. Maybe they need to save as much space as possible, and recent versions of GCC are too big. There are all sorts of reasons why someone might be stuck with old software. But, they may need the latest Linux kernel because it's the foundation of their entire product, so they're stuck trying to compile it with an old compiler.

However, Linux can't really support every single GCC version. Sometimes the GCC people and the kernel people have disagreed on the manner in which GCC should produce code. Sometimes this means that the kernel really doesn't compile well on a particular version of GCC. So, there are the occasional project wars emerging from those conflicts. The GCC people will say the compiler is doing the best thing possible, and the kernel people will say the compiler is messing up their code. Sometimes the GCC people change the behavior in a later release, but that still leaves a particular GCC version that makes bad Linux code.

So, the kernel people will decide programmatically to exclude a particular version of GCC from being used to compile the kernel. Any attempt to use that compiler on kernel code will produce an error.

But, sometimes the GCC people will add a new language feature that is so useful, the kernel will people decide to rely heavily on it in their source code. In that case, there may be a period of time where the kernel people maintain one branch of code for the newer, better compiler, and a separate, less-fast or more-complex branch of code for the older, worse compiler. In that case, the kernel people—or really Linus Torvalds—eventually may decide to stop supporting compilers older than a certain version, so they can rip out all those less-fast and more-complex branches of code.

For similar reasons, it's also just an easier maintenance task for the kernel folks to drop support for older compilers; so this is something they would always prefer to do, if possible.

But, it's a big decision, typically weighed against the estimated number of users that are unable to upgrade their compilers. Linus really does not want even one regular (that is, non-kernel-developer) user to be unable to build Linux because of this sort of decision. He's willing to let the kernel carry a lot of fairly dead and/or hard-to-maintain code in order to keep that from happening.

Go to Full Article
Zack Brown

Canonical Releases Minimal Ubuntu, Mozilla Launches Two Mobile Test Pilot Experiments, Google Announces Jib for Java Developers, New Ubuntu Bug Discovered and Wine 3.12 Now Available

3 months 1 week ago

News briefs for July 10, 2018.

Canonical released its new Minimal Ubuntu yesterday. According to the Ubuntu blog, Minimal Ubuntu is "optimized for automated use at scale, with a tiny package set and minimal security cross-section. Speed, performance and stability are primary concerns for cloud developers and ops." The images are 50% smaller than the standard Ubuntu server images and they boot up to 40% faster. Minimal Ubuntu also is fully compatible with standard Ubuntu operations. You can download it here.

Mozilla launches two new Mobile Test Pilot Experiments: Firefox Lockbox for iOS and Notes by Firefox for Android. Firefox Lockbox allows iOS users to access Firefox-saved passwords saved in the browser to log in to any online account or app. With Notes by Firefox, users can "sync notes from any Firefox browser on any Android smartphone or tablet", and the notes are end-to-end encrypted as well. These projects are experimental, and Mozilla welcomes feedback here.

An Ubuntu bug that allows anyone with physical access to the computer to bypass the lockscreen by removing the hard drive has just been made public. According to the Neowin post, the bug was tested on Ubuntu 16.04.4, and it's not certain whether it affects other Ubuntu versions or distributions.

Google announced the release of Jib yesterday, an open-source Java tool that allows developers to build containers. Jib is "a fast and simple container image builder that handles all the steps of packaging your application into a container image", and you don't need to write a Dockerfile or have docker installed to use it.

Wine 3.12 is now available. This release contains many bug fixes, and other new features include Unicode data upgraded to Unicode 11.0.0, proxy configuration dialog in internet control panel, more glyphs in the Wingdings font and more.

News Canonical Ubuntu Cloud Containers Mozilla Firefox Mobile Android Security Google Java Docker Wine
Jill Franklin

DIY RV Offsite Backup and Media Server

3 months 1 week ago
by Kyle Rankin

What better way to add a geeky touch to #vanlife than with a Linux server in your RV?

One easily could make the strong argument that an RV is the ultimate DIY project playground. It combines all of the DIY projects you could perform on a vehicle with the DIY projects for a home. Add to that the fact that you may spend days living in a small house on wheels navigating highways, forests and deserts, and you have a whole other class of DIY projects to make the most of that smaller space. RVs also offer a whole suite of power options from 12V deep cycle batteries to 110V shore power to generators and alternators to solar power, so there's a whole class of electrical DIY projects related to making the most of your changing power options.

And if you're a geek, having an RV introduces a whole other level of DIY possibilities. First, there are all of the electronics projects to manage switching between power sources, tracking energy consumption and keeping those batteries charged. Then there's an entire category of projects related to internet access while away from home that involve everything from mobile WiFi hotspots to cellular-boosting networks to roving satellite internet (and if you're clever, a smart router that routes you to the best and cheapest available option). Finally, there are several project possibilities related to the computer systems in the RV, including local switches and routers, personal computers that turn the RV into a mobile office, and media centers so you can watch TV and movies from the road.

It just so happens that I recently got an RV—a 1996 Roadtrek 170 to be exact. Although this purchase has spawned a huge list of DIY projects, my very first Linux-based project focuses on the media center. At home, my media center is a Raspberry Pi running OSMC, and it works great for accessing my ripped DVDs and CDs from my NAS and playing them on my living-room TV. When I got the RV, I realized that one of the first things we'd want is a way to access all of that media from the road, even if we were in the middle of the woods.

In this article, I describe all the steps I took to build a media server just for the RV that maintains an up-to-date copy of my media and even syncs up automatically when it's parked in my driveway. It turns out that in the process of building a media server, I ended up with a pretty great off-site backup solution as well. Even if you don't own an RV, you could adapt these steps to add your own semi-offsite backup to your car.

Figure 1. Introducing "Van Winkle" (Photo Credit: Joy Rankin)

Go to Full Article
Kyle Rankin

Oasis Labs to Create Blockchain-Based Privacy-First Cloud Computing Platform, Elisa Music Player Version 0.2 Released, Unitary Fund Awarding Grants to Projects Developing Open-Source Quantum Software and More

3 months 1 week ago

News briefs for July 9, 2018.

Oasis Labs raises $45 million to create a privacy-first blockchain cloud computing platform. According to the Venture Beat post, the Oasis Labs' goal for the platform is to "overcome the performance, security, and privacy limitations that have hampered blockchain adoption to date. The aim is to make blockchain, a distributed secure ledger that powers cryptocurrencies such as Ethereum, more useful to a broader set of companies."

Firefox 61.0.1, the first minor maintenance update for Firefox 61, has been released, Softpedia News reports. The update includes performance improvements and bug fixes, and you can download it from here.

The Elisa music player team recently announced the release of version 0.2. This update brings new music browsing views as well as an improved interface and performance improvements. The team notes their goal is "creating a reliable product that is a joy to use and respects our users privacy. As such, we will prefer to support online services where users are in control of their data." See the Change Log for all the details.

The Rust programming language team has issued a security advisory for its rustdoc plugins. Here's the rundown: "The problem was in rustdoc's obscure plugin functionality, consisting of its loading plugins from a path that is globally writable on most platforms, /tmp/rustdoc/plugins. This feature permitted a malicious actor to write a dynamic library into this path and have another user execute that code. The security issue only happens if you're actively using the feature, and so this behavior will be removed from rustdoc in the near future, with patches landing for each channel over the next week."

The Unitary Fund, which was created with "personal donations from founder of security firm Lookout, John Hering, and developer of quantum integrated circuits Rigetti Computing product manager Nima Alidoust", recently launched. The fund is offering $2000 grants to projects developing open-source quantum software. According to ComputerWorld, "Any project that 'will benefit humanity that leverages near-term quantum computing' qualifies to apply for the fund.

News Blockchain Privacy Rust Programming Security Quantum Computing Firefox
Jill Franklin

UserLAnd, a Turnkey Linux in Your Pocket

3 months 1 week ago
by Petros Koutoupis

There comes a time when having a full-fledged Linux distribution within reach is necessary or just plain useful. And, what could be more within reach than having that same distribution on a computing device most people have with them at all times? Yes, I'm talking about a smartphone—specifically, an Android-powered smartphone. Enter UserLAnd.

UserLAnd offers a quick and easy way to run an entire Linux distribution, or even just a Linux application or game, from your pocket. It installs as an Android app and is available for download from the Android Google Play Store. The best part is that because it operates from a typical chroot environment, you don't need to root your device.

I was fortunate enough to have a chance to spin up one of the early beta builds of UserLAnd. This beta build was limited only to SSH and VNC local connections from my Android mobile device, but it was more than enough to establish a sound sense of how things are and where things will progress.

To handle the SSH connection, UserLAnd leverages ConnectBot while using bVNC for anything graphical. The beta build I used supported only TWM. Future updates will add additional window managers and a desktop environment. Both ConnectBot and bVNC are installed when you create and launch your session (see below).

Immediately after installation and upon launching the application, you are greeted with a clean environment—that is, no root filesystems and no sessions defined.

Figure 1. A Fresh and Clean Installation of UserLAnd

There isn't much to do here until you create a base root filesystem to use in one or more connected sessions. Now, because this was a beta build, my option was limited to Debian.

Figure 2. Creating a Root Filesystem

Once the root filesystem is created, you can create your session, which includes connection type and user name. For connection types, in my case, the drop-down menu listed ConnectBot for the command-line interface and bVNC for a graphical environment. Future releases will add more options.

Figure 3. Creating Your Connection Sessions

Go to Full Article
Petros Koutoupis

Weekend Reading: Python

3 months 1 week ago
by Carlie Fairchild

Python is easy to use, powerful, versatile and a Linux Journal reader favorite. We've round up some of the most popular recent Python-related articles for your weekend reading.

  • Introducing PyInstaller by Reuven M. Lerner: Want to distribute Python programs to your Python-less clients? PyInstaller is the answer.

  • Examining Data Using Pandas by Reuven M. Lerner: You don't need to be a data scientist to use Pandas for some basic analysis.

  • Multiprocessing in Python by Reuven M. Lerner: Python's "multiprocessing" module feels like threads, but actually launches processes.

  • Launching External Processes in Python by Reuven M. Lerner: Think it's complex to connect your Python program to the UNIX shell? Think again!

  • Thinking Concurrently: How Modern Network Applications Handle Multiple Connections by Reuven M. Lerner: exploring different types of multiprocessing and looks at the advantages and disadvantages of each.

  • Threading in Python by Reuven M. Lerner: threads can provide concurrency, even if they're not truly parallel.

  • Using Python for Science by Joey Bernard: introducing Anaconda, a Python distribution for scientific research.

  • Visualizing Molecules with Python by Joey Bernard: introducing PyMOL, a Python package for studying chemical structures.

  • Novelty and Outlier Detection by Reuven M. Lerner: we look at a number of ways you can try to identify outliers using the tools and libraries that Python provides for working with data: NumPy, Pandas and scikit-learn.

  • Learning Data Science by Reuven M. Lerner: I've written a lot about data science and machine learning. In case my enthusiasm wasn't obvious from my writing, let me say it plainly: it has been a long time since I last encountered a technology that was so poised to revolutionize the world in which we live.

Go to Full Article
Carlie Fairchild

Dell Precision 7530 and 7730 Mobile Workstations with Ubuntu Preinstalled Now Available, Linux Ultimate Gamers Edition Launched Its 5.8 ISO, Feral's GameMode Coming Soon to Fedora, CentOS 6.10 Released, Security Upgrades for Ubuntu and More

3 months 1 week ago

News briefs for July 6, 2018.

The Dell Precision 7530 and 7730 Mobile Workstation Developer Editions are now available via Dell's online store with Ubuntu Linux preinstalled, Softpedia News reports. The Mobile Workstations are powered by the latest Intel Core or Xeon processors, and "feature blazing-fast RAM, professional AMD or Nvidia graphics cards, and are certified for the Red Hat Enterprise Linux 7.5 operating system". Prices for the "world's most powerful 15" and 17" laptops with Ubuntu pre-installed" begin at $1,091.14 for the 7530 and $1,371.37 for the 7730.

Linux Ultimate Gamers Edition launched its 5.8 ISO, which you can download from SourceForge or Softpedia. Ultimate Gamers is based on Debian and Ubuntu, with the MATE desktop environment. According to the Appuals post, "it comes with out-of-the-box support for nearly any kind of multimedia file that a gamer would ever want to play....It also comes with dozens of applications gamers and A/V fans will need. Most importantly, it comes with Wine pre-loaded, which is extremely important for those who want to run popular online games."

Feral Interactive's GameMode is coming soon to Fedora Linux, Phoronix reports. GameMode is "a new open-source project that provides a Linux system tuning daemon for optimizing the system's configuration for gaming when firing up Linux games while reverting to stock behavior when outside of supported games". Phoronix notes that it has been working its way into various Linux distros' package management systems, and that as of today it "has been submitted as the newest package for Fedora Rawhide as the development version ultimately leading to Fedora 29."

CentOS announced the availability of CentOS Linux 6.10. In this release GCC now supports retpolines for Spectre variant 2 mitigation. See the release notes for all the changes.

Canonical has released new kernel security updates for Ubuntu 18.04 LTS (Bionic Beaver), Ubuntu 17.10 (Artful Aardvark), Ubuntu 16.04 LTS (Xenial Xerus), as well as Ubuntu 14.04 LTS (Trusty Tahr). According to Softpedia, the updates fix 22 security vulnerabilities, and users are urged to update their installations as soon as possible. See the Ubuntu wiki's Upgrades page for instructions.

The Linux Foundation recently announced new blockchain training options. Blockchain: Understanding Its Uses and Implications is a free edX course beginning on August 1, 2018, and there's also an option for a professional certificate for $99. According to the post on, the new program provides "a way to learn about the impact of blockchain technologies and a means to demonstrate that knowledge. Certification, in particular, can make a difference for anyone looking to work in the blockchain arena".

News Hardware Laptops Dell Ubuntu Canonical gaming The Linux Foundation Blockchain Security Spectre
Jill Franklin

FOSS Project Spotlight: ONLYOFFICE, an Online Office Suite

3 months 1 week ago
by Tatiana Kochedykova

ONLYOFFICE is a free and open-source office suite that provides an alternative for three major MS Office apps—Word, Excel and PowerPoint—working online.

ONLYOFFICE's main features include:

  • Text, spreadsheet and presentation online viewers and editors.
  • Support for all popular file formats: DOC, DOCX, ODT, RTF, TXT, PDF, HTML, EPUB, XPS, DjVu, XLS, XLSX, ODS, CSV, PPT, PPTX and ODP.
  • A set of formatting and styling tools common for desktop office apps.
  • A set of collaboration tools: two co-editing modes (fast and strict), commenting and built-in chat, tracking changes and version history.
  • Ready-to-use plugins: Translator, YouTube, OCR, Photo Editor and more.
  • Macros to standardize work with documents.
  • Support for hieroglyphs.

Figure 1. ONLYOFFICE Formatting and Styling Tools

Ways to use ONLYOFFICE:

  • Integrated with a collaboration platform: for teams, ONLYOFFICE can be installed together with a set of productivity tools designed by ONLYOFFICE that includes CRM, projects, document management system, mail, calendar, blogs, forums and chat.
  • Integrated with popular web services: for users of popular services like Nextcloud, ownCloud, Alfresco, Confluence or SharePoint, ONLYOFFICE offers official connectors to integrate online editors and edit documents within them. Some web services, like the eXo Platform, provide users with their own connectors or offer instructions like Seafile for integration with ONLYOFFICE.
  • Integrated with your own web apps: for developers who are building their own productivity app, no matter what kind of application they provide to users or which language they use to write it, ONLYOFFICE offers an API to help them integrate online editors with their apps.

Figure 2. Co-Editing with ONLYOFFICE

To use this online office suite, you need to have the ONLYOFFICE Document Server installed, and you can choose from multiple installation options: compile the source code available on GitHub, use .deb or .rpm packages or the Docker image.

Go to Full Article
Tatiana Kochedykova

EU Rejects Copyright Directive, Four openSUSE Tumbleweed Snapshots Released, DoublePulsar Modified to Work on Windows IoT Systems, Kdenlive Wants Your Feedback and GIMP 2.10.4 Now Available

3 months 1 week ago

News briefs for July 5, 2018.

The EU has rejected the controversial "Copyright Directive" legislation. Mozilla's head of EU public policy stated "The European Parliament has today heard the voice of European citizens and voted against proposals that would have dealt a hammer blow to the open internet in Europe. The future of an open internet and creativity in Europe depends on it." Those in favor of the Directive said "rejecting it further entrenches the power of large US tech companies, while hurting individual artists and creators." The legislation now returns to the drawing board and will be sent in for another vote in September. See The Verge for details on the provisions and hopes for an "open debate".

Four openSUSE Tumbleweed snapshots were released this week and are "trending stable" with major version packages. The packages updated include FFmpeg, KDE Plasma, GNOME Builder, Krita and a kernel update.

An infosec researcher who goes by Capt. Meelo has modified the NSA hacking tool called DoublePulsar (which was stolen last year and leaked online by a group called the Shadow Brokers) to work on the Windows IoT operating system. This could affect systems like IoT devices, point-of-sale kiosks and ATMS. BleepingComputer reports that "the only way to protect against having these devices corraled into a botnet via DoublePulsar is to apply the security updates included in MS17-010, the security bulletin that contains patches against the hacking tools and exploits leaked online by The Shadow Brokers last year, including DoublePulsar."

Kdenlive needs your feedback. You can help by downloading the Appimage and trying it on your computer: "just download the file, make it executable through your file manager and run it". New features include clips with both video and audio are now separated automatically when dropped in the timeline, you can now easily enable/disable all clip types in the timeline, slow motion should work reliably and much more. You can leave comments and feedback on this beta version on this post.

GIMP 2.10.4 was released yesterday. This new update includes bugfixes, simple horizon straightening, asynchronous fonts loading, fonts tagging, dashboard updates and more. News EU Copyright openSUSE Security NSA IOT Windows Kdenlive GIMP multimedia
Jill Franklin

Removing Support for Dead Hardware

3 months 1 week ago
by Zack Brown

Arnd Bergmann submitted a patch to remove the Linux ports for a variety of architectures, including blackfin, cris, frv, m32r, metag, mn10300, score and tile. To do this, he worked directly with the former maintainers of each port to make sure the code removal was done right and didn't break anything in the mainline kernel or anywhere else.

The bottom line was that no one used those architectures anymore. He offered his analysis of why this had happened, saying:

It seems that while the eight architectures are extremely different, they all suffered the same fate: There was one company in charge of an SoC line, a CPU microarchitecture and a software ecosystem, which was more costly than licensing newer off-the-shelf CPU cores from a third party (typically ARM, MIPS, or RISC-V). It seems that all the SoC product lines are still around, but have not used the custom CPU architectures for several years at this point. In contrast, CPU instruction sets that remain popular and have actively maintained kernel ports tend to all be used across multiple licensees.

Linus Torvalds had no objection to ripping those architectures out of the kernel, but he did say, "I'd like to see that each architecture removal is independent of the others, so that if somebody wants to resurrect any particular architecture, he/she can do so with a revert."

Linus pulled the patch into the main kernel tree and noted with glee that it took a half-million lines of code out of the kernel.

Linus was not the only one who wanted to ensure the possibility of easily resurrecting those architectures. Geert Uytterhoeven wanted to know exactly what would be required, since he had an interest in the formerly removed and later resurrected arch/h8300 architecture, currently still in the kernel and going strong. And he pointed out, "In reality, a resurrection may not be implemented as a pure revert, but as the addition of a new architecture, implemented using modern features."

To which Pavel Machek complained, "By insisting on new features instead of pure revert + incremental updates, you pretty much make sure resurrection will not be possible."

But Arnd pointed out, "now that the other architectures are gone, a lot of changes can be done more easily that will be incompatible with a pure revert, so the more time passes, the harder it will get to do that."

And he added, "Some of the architectures (e.g. tile or cris) have been kept up to date, but others had already bitrotted to the point where they were unlikely to work on any real hardware for many releases, but a revert could still be used as a starting point in theory."

Go to Full Article
Zack Brown

Advertising 3.0

3 months 2 weeks ago
by Doc Searls

First came branding through sponsorship. Then came eyeball-chasing through adtech. Now comes sponsorship again, this time supporting a mission as big as Linux.

This editorial is my first and only sales pitch. It's for brands to sponsor Linux Journal.

I'm also not just speaking as a magazine editor. I've studied advertising from inside and out for longer than most people have been alive.

During my inside years, I was a founder and creative director of one of Silicon Valley's top advertising agencies, with my name emblazoned on a building in Palo Alto.

In my outside years, I've been one of the biggest opponents of adtech: tracking-based advertising. And I've been just as big a proponent of advertising that builds and maintains brands while sponsoring the best journalism.

What we bring to the table are the smartest and most savvy tech readers in the world, plus a mission for advertising itself: to turn away from eyeball-chasing and back to what builds brands and sells products—but in ways that aren't bullshit. Tall order, but it can be done.

Our readers can help with that, because they have the world's best bullshit filters—and the world's best appreciation of what's real and works. They are also influential without being what marketers call "influencers". In fact, I'm sure most of them would hate being called "influencers," because they know "influencer marketing" actually means "using experts as tools".

Advertising that isn't bullshit starts with sponsorship. That means you advertise in a magazine because it's valuable to the world, has readers that are the same, and you know it will help those readers and the world know about the goods you bring to the market's table.

The biggest reason our readers are valuable is that the whole tech world runs on Linux now. They had something to do with that, and so did we.

Another fact: sponsors made Linux Journal a success no less than our writers and other employees did.

Now is also the right time for brands to walk away from the disaster that tracking-based advertising, aka adtech, has become. The General Data Protection Regulation, aka GDPR, is just one sign of it. Another is that a $trillion or more has been spent on tracking-based ads, and not one brand known to the world has been made by it. Many have been harmed.

We may be small as magazines go, but our ambitions are not. We wish to be nothing less than the best technology magazine on Planet Earth. If you sponsor us, you're on for that ride too.

Go to Full Article
Doc Searls

Gmail Developers Read Your Email, Bodhi Linux Media Is a New Distro for Artists, Mozilla's July Featured Extensions and More

3 months 2 weeks ago

News briefs for July 3, 2018.

The Wall Street Journal reported yesterday that Gmail allows data companies and developers to see users' email and private details, and read entire messages. According to a related story on The Verge, while some email apps "do need to receive user consent, the consent form isn't exactly clear that it would allow humans—and not just computers—to read your emails." In addition, Google told The Verge that it gives data only to "vetted third-party developers and with users' explicit consent" and also that Google employees may read your email, but only in "very specific cases where you ask us to and give consent, or where we need to for security purposes, such as investigating a bug or abuse".

There's a new distro called Bodhi Linux Media, derived from Bodhi Linux, "a lightweight, Ubuntu-based distro that includes only a browser, a terminal emulator, and a few other system tools". For Bodhi Linux Media, creator Giuseppe Torre customized the desktop interface, "capitalizing on the fact that the operating system is fast and lean (with no random stuff running in the background)" and curated the software specifically for artists in many different digital art fields. The software includes Adobe alternatives (GIMP, Inkscape, Natron, Scribus and Synfig Studio), Ardour, Arduino IDE, Atom, Audacity, Blender, Firefox, Krita, LibreOffice, MuseScore, Open Broadcaster, Processing, Pure Data, SuperCollider and VLC. See Giuseppe's article on for more details.

Mozilla has announced its Featured Extensions for July. This month's extensions include Midnight Lizard, which lets you "customize readability of the web in granular detail", and Black Menu for Google, which provides "easy access to Google services like Search, Translate, Google+, and more without leaving the webpage you're on". The other extensions are Authenticator for two-step verification security; Turbo Download Manager with multi-threading support; and IP Address and Domain Information, which shares "detailed information about every IP address, domain, and provider you encounter in the digital wild".

In other Mozilla news, Mozilla yesterday endorsed the Brazilian Data Protection Bill (PLC 53/2018). In summary, "The lack of a comprehensive data protection law exposes Brazilian citizens to risks of misuse of their personal data by both government and private services. This is a timely and historic moment where Brazil has the opportunity to finally pass a baseline data protection law that will safeguard the rights of Brazilians for generations to come."

The Association for Computing Machinery's US Technology Policy Committee (USACM) yesterday made "detailed recommendations to Congress for protecting personal privacy in the wake of the Facebook/Cambridge Analytica controversy". View the USACM statement to learn about its nine goals for personal privacy protection legislation. The Association for Computing Machinery (ACM) is "the world's largest and longest -established association of computing professionals representing approximately 50,000 individuals in the United States and 100,000 worldwide".

News multimedia Gmail Google Privacy Bodhi Mozilla Firefox
Jill Franklin

DIY: Build a Custom Minimal Linux Distribution from Source

3 months 2 weeks ago
by Petros Koutoupis

Follow along with this step-by-step guide to build your own distribution from source and learn how it installs, loads and runs.

When working with Linux, you easily can download any of the most common distributions to install and configure—be it Ubuntu, Debian, Fedora, OpenSUSE or something entirely different. And although you should give several distributions a spin, building your own custom, minimal Linux distribution is also a beneficial and wonderful learning exercise.

When I say "build a custom and minimal Linux distribution", I mean from source packages—that is, start with a cross-compiling toolchain and then build a target image to install on a physical or virtual hard disk drive (HDD).

So, when I think of the ultimate Do-It-Yourself (DIY) guide related to Linux, it's got to be exactly this: building a Linux distribution from source. The entire process will take at least a couple hours on a decently powered host machine.

If you follow along with this exercise, you'll learn what it takes to build a custom distribution, and you'll also learn how that distribution installs, loads and runs. You can run this exercise on either a physical or virtual machine.

I'd be lying if I said that this process wasn't partly inspired by the wonderful Linux From Scratch (LSF) project. The LSF project proved to be an essential tool in my understanding of how a standard Linux operating system is built and functions. Using a similar philosophy, I hope to instill some of the same wisdom to you, the reader, if you'd like to follow along.

  • Host: the host signifies the very machine on which you'll be doing the vast majority of the work, including cross compilation and installation of the target image.
  • Target: the target is the final cross-compiled operating system that you'll be building from source packages. It'll be built using the cross compiler on the host machine.
  • Cross compiler: you'll be building and using a cross compiler to create the target image on the host machine. A cross compiler is built to run on a host machine, but it's used to compile for a target architecture or microprocessor that isn't compatible with the host machine.
Prerequisites and Tools

To continue with this tutorial, you'll need to have GCC, make, ncurses, Perl and grub tools (specifically grub-install) installed on the host machine.

In order to build anything, you'll also need to download and build all the packages for the cross compiler and the target image. I'm using the following open-source packages and versions for this tutorial:

Go to Full Article
Petros Koutoupis