Indholdsfortegnelse for September 2018 i Linux Format

Jonni Bidwell If we had access to UK rail passenger data, delays and carriage counts, we might not be able to make the trains run perfectly and wonderfully. But at least we could create nice visualisations of how atrocious they are and stultify train companies’ awful social media responses. John Knight Data harvesting usually has a negative connotation. I’d like to see applications as commonplace as Twitter that show users where their privacy is being compromised and where money may be disappearing, for households to make more informed decisions day to day. Nick Peers Open data should be used to explore the murky depths of who funds what. Then we might start to regain some control over those people and institutions who make huge decisions, not just supposedly on our…

“How many security updates are outstanding on your servers? If you’re not monitoring, the answer to that question for your servers is: you should be. When we take on a new client, we carry out a check on the servers we’re going to support, and one thing we check is whether any security updates are outstanding. We’ve never found a server that was fully up to date during that process. Just think about that. The inference is that the majority of Linux servers out there aren’t up to date. And there’s no reason why they shouldn’t be. If there’s resistance within the business to installing security updates, it’s your job to challenge that. Security compromises are not limited to ‘other people’, and the only safe way to recover from one…

Guido van Rossum sent shockwaves through the Python community in July when he announced he was standing down as BDFL (benevolent dictator for life) for the language he invented in 1990. In a note entitled Transfer of Power (which can be read at http://bit.ly/LXFGuidoQuits), Guido says that, “Now that PEP 572 is done, I don’t ever want to have to fight so hard for a PEP and find that so many people despise my decisions. I would like to remove myself entirely from the decision process.” The note hints at the acrimony over a proposal (PEP 572) to tidy up subexpressions, which he expands on in an interview with InfoWorld (http://bit.ly/LFXGuidoInterview).Guido continues: “I’ll still be there for a while as an ordinary core dev, and I’ll still be available to…

MAKER FAIRE DERBY Taking place on October 27 at Eagle Market, Derby, this one-day event is for makers across the spectrum to come together, show off their projects, make friends and talk about their passion for making. This free event is a great way to get your work seen, so submit your project today! More details are at the website: http://derby.makerfaire.com. MADLAB MANCHESTER Madlab has joined forces with PLANT NOMA and are working to develop the digital and making skills of creators based in the North West of England. The new space offers more hot desking and co-working spaces, while still retaining the regular meetings for Manchester Free Software, Wordpress user groups and a FabLab. More details can be found on the website, including upcoming courses and events to help…

Q like I’ve you just folks installed , am Mint thoroughly 19 and, impressed. However, I’m now trying to install it on a friend’s laptop, and it’s not playing ball. I’m reasonably sure this is some sort of UEFI issue, as the install appears to go fine until it tries to install GRUB. My machine uses classic BIOS, but my friend needs UEFI to dual-boot the Windows. I don’t want to mess around with having to switch between BIOS and UEFI to change operating systems, and nor do I want to risk breaking the Windows install by putting BIOS-mode GRUB in the master boot record. Henry Cornhill, via email A Yep, after Mint was released an update to the Ubuntu package ( ubuntu-system-adjustments ) broke part of Mint’s GRUB EFI…

The 970 Pro is part of Samsung’s third-generation of high-end NVMe SSDs. Its previous efforts have been about as good as consumer SSDs got. So, if third time truly is lucky, and the 970 Pro is even better… well, Samsung just got scary. It’s over 18 months since the Samsung 960 Pro (see LXF207 for our 950 Pro review) debuted. That’s an aeon in the fast-moving world of solid-state storage. In that period, Intel has rebooted expectations with its revolutionary 3D Xpoint tech. Meanwhile, several other SSD manufacturers have upped their game, too. So, what does the 970 Pro bring to the M.2-format SSD table? Inevitably, there’s a new controller chipset, the Samsung Phoenix. We’ve seen it before in the 970 Evo (see LXF238), the 970 Pro’s cheaper sibling. Equally…

Besides being fun and easy, we’re looking for a tool that supports an assortment of file formats, such as MP3 and OGG. We’re also interested to see whether or not it’s possible to connect to internet radio with the tool. Most important of all, perhaps, we want a distribution-neutral project. We’ve tested these players on both Ubuntu and Fedora, running Budgie and the Gnome desktop respectively. This was done to test a player’s desktop integration skills. Unlike their video-playing counterparts, music players are not particularly resource hungry. However, we still wouldn’t mind having a player that’s as at home on older, low-spec machines as on modern computing powerhouses. Since musical tastes change with time, and because many of your favourite bands will keep putting out more music – except for…

Despite offering a similar feature set out of the box, some of the players in this Roundup manage to come across as sleek and pleasant, while others just look clumsy. It’s not just the positioning of the various elements that makes the difference, either, but also the way they work. Not all of the apps are intuitive to use, and the lack of thorough documentation can easily make the difference between you persisting with an app, or not – especially with so many options for you to choose from. If you’re the kind of person who likes to play a little music in the background while you get on with work, you will most likely be indifferent to the way a player looks, and will probably prefer one that can…

While we have restricted ourselves to graphical tools, there are also a few command-line options worth your time. Except for support for online radio stations and services such as Magnatune and Jamendo, cmus is an exceptionally well put together Terminal utility, and offers all the other features that its graphical counterparts do. If instead of your own local collection of music, you’re only interested in online sources, Nuvola is meant solely for you. For those who favour the Winamp theme, qmmp is a viable alternative, but like cmus, this app also lacks support for online services. Also like cmus, you can also use qmmp to fetch song lyrics for the currently playing track. Users with music collections spanning several GBs might consider using Quod Libet. In addition to playing music,…

Targeting a single machine or network is all well and good, but some people (or nation states) dream bigger. On at least one occasion last year, great swathes of Internet traffic (belonging to high-profile companies like Facebook, Apple and Google were rerouted through Russian networks. These kind of Border Gateway Protocol (BGP) hacks have long been warned about, since BGP was invented essentially as a band aid. The internet is a network of networks, so-called Autonomous Systems, and these are all meant to announce their peering arrangements and connectivity in an open and honest manner, so traffic can be routed swiftly and efficiently. There aren’t any concrete defences against abuse of this system though, and the BGPmon website (https://bgpmon.net) regularly reports anomalous route announcements. BGP is complicated, so many of…

TARGET HAS BEEN SIGHTED “Rapid7 has released a specially crafted virtual machine, Metasploitable 3, that’s vulnerable to all kinds of attacks” We think having vulnerabilities and proof-of-concept exploits out in the open is, despite various straw man arguments to the contrary, A Good Thing. However, if you’re a pentester (or dream of being one) and want to test a target machine for several vulnerabilities, then unfortunately you’re in for a bit of a rough ride. Proof of Concept (PoC) code will probably require some customisation and dependencies to be installed before it works. For memory-related vulnerabilities, code will need to be compiled, too. In addition, there’s all the rigmarole of trawling through mailing lists to get the code in the first place. Wouldn’t it be nice if someone had some…

Ever since people began connecting their PHP applications to SQL databases, there have been SQL injection attacks. These exploit unchecked – sanitise everything – user inputs, typically in web forms, to make it possible for the attacker to run arbitrary SQL queries. The classic example is to input something like ‘; DROP TABLE users; into the username field form. If the PHP code behind that form generated an SQL query in a manner such as: then if the $user variable is substituted with our poisoned input we end up with two SQL queries for the price of one: And then our “users” table disappears in a puff of unsanitised input. The reason this works (in reality it should not work in any places because PHP no longer allows SQL statements…

In 1974, Arlis Perry was murdered at Stanford University. Her murder was never solved. Well, until now. She may have been one of the victims of a serial killer only discovered years after her death, and hours before his. In a recent interview, July 2018, the Santa Clara County Sheriff revealed that the department is going to look into this cold case after work done with the NBC Bay Area and the Murder Accountability Project found evidence that Arlis may have been the victim of a newfound serial killer, a man called Stephen Crawford. While proof is still being gathered and a case still being made, the data is compelling. “DNA testing found evidence that Stephen Crawford was suspect in the 1974 murder, but when the police went to knock…

1 Boot the live medium Feren can be installed straight from the Linux Format DVD, so the first step is to fire that up. Check out the DVD FAQ if you run into difficulties. Select Feren OS with the cursor keys and fire it up. Use the install button from the Welcome screen or the icon at the top-left of the desktop. 2 Select your locale Choose language and keyboard layout preferences. Then comes the third-party question; you’re probably best to tick this box. There are idealogical reasons for not doing so (it installs code that’s incompatible with software freedom), but it might be needed for your Wi-Fi to work. 3 Install the ’ system If you don t select dual-boot, Feren will wipe your main hard drive. The dual-boot…

When not fixing IT problems, I enjoy making, tinkering, retro computing and building electronics projects. Being an active contributor to the maker community I can often be found exhibiting at various Raspberry Pi Jams and I have been known to run ad-hoc training courses. I enjoy building projects based around the Raspberry Pi and micro:bit to show people what can be done with these devices. I first became aware of the Raspberry Pi back in 2012. Over the years I’ve bought the latest Raspberry Pi models when they’ve been released. I think I can safely say I’ve definitely caught the Raspberry Pi bug! Once I owned a Raspberry Pi, I thought about what I could do with it. I started reading magazines, buying various breakout boards and shiny LED based…

Using the hostname to connect to your Pi is great for Linux and Mac users (who have this installed by default) and Windows users who have installed Bonjour. But for Android users, or those that wish to only use IP addresses, how can we reliably connect to our Pi? First we need to be sat at the Pi that we wish to access, with keyboard, mouse etc ready for use. In a Terminal, we need to find out the IP address of the Pi. Type the following and press Enter. $ hostname -I Be sure to make a note of the IP address. Next, in the same Terminal, let’s use that IP address to create a static IP address. In the Terminal type the following and press Enter. $ sudo…

Honeypots have evovled from the defunct Nepenthes through its replacement Dionaea https://dionaea.readthedocs.io. The resource information provided on the Github link (https://github.com/paralax/awesome-honeypots#honeyd) is a testament to the evolution of the technology and what they are capable of providing. With the evolution of honeypots (collectors) a need for management and logging of the information became important. Modern Honey Network (MHN) (https://github.com/threatstream/mhn) is a centralised server, for deploying collectors, gathering their data and providing a Web interface for management. In 2001 the Internet Storm Center (ISC) was created following the successful detection, analysis and widespread warning on the Li0n worm. The ISC provides warning services to Internet users and works to combat malicious attackers by supporting a distributed detection system called DShield (https://secure.dshield.org/about.html). DShield collects data about malicious activity from across the Internet.…

The RetroPie website claims that if you have a legal copy of a game, it’s lawful to download the corresponding ROM. However, you should check carefully whether this holds true in your own jurisdiction. If you do have a legal copy of a game such as StarCraft, Doom or Baldur’s Gate, there are a number of ports of the RetroPie software designed specifically to run the games’ original files. See https://github.com/retropie/retropie-setup/wiki/Ports for a full list. If you still have any Sega Mega Drive/Genesis or Super Nintendo cartridges, you could invest in a Retrode. This is a gadget into which you can insert game cartridges, then access the files on them via USB on a computer. There’s also an adapter that can be purchased separately to play Nintendo 64 games. The…

It’s unlikely for any self-respecting Bash ninja to ever complain of a task or tool requiring too much work or configuration, but if you find yourself on the fence about Wego because of its many configurable options, we have an alternate for you. The wttr.in service requires Python and utilises Wego and WorldWeatherOnline API to fetch the weather details for your location. But if you don’t want to go through the process of setting it up, you can alternatively get the weather details on your machine with just the curl utility. The command curl wttr.in/Delhi will fetch the weather and present it in ASCII art the same as Wego does. You can also use wttr.in to check the weather at any airport by providing the three letter airport code, or…

If you’d like to be able to control Bluetooth via the Terminal or other shell, then all the tools you need are installed with the bluezand blueztoolspackages. While hcitoolis traditionally used to scan for, pair and connect devices, an easier tool is bluetoothctl. Enter the command-line package: From here type help where you’ll find plenty of familiar-looking commands – ‘scan on’ to put it into scanning mode, for example. Devices will appear as they’re detected, or you can type ‘devices’ for an updated list. Once you’ve found a device, pair it like so: Device ID is the six-digit hexadecimal code (1A:2B:3C:4D:5E:6F) that appears next to the device description. To save time, type the first digit of its device ID and press Tab to auto-complete. Once paired, type trust <device ID>…

OUR EXPERT John Knight has recovered from his latest Australian spider bite and writes ebooks on how to play the drums. Do a quick Google search for ebook editors and one name will keep appearing: Sigil (https://sigil-ebook.com). At first glance this may be puzzling, because despite a fairly restricted interface, similar functionality being built into newer programs, multiple developers moving on and numerous changes in maintainership, Sigil usage is still going strong and is as popular as ever and available direct from many popular distro repositories. According to the website, Sigil is a multi-platform WYSIWYG epub ebook editor with full UTF-16 support, spell checking, and complete manual control over ebook syntax. Sigil can import HTML files, images, and style sheets with full Epub 2 support, although Epub 3 support is…

If Sigil’s interface is simply too irksome for you, then you may prefer to just write in a word processor and then convert the results to .epub. You can use an online converter, but we like and trust the Linux tool, pandoc, which does excellent conversions. If you also want to try pandoc, (see also p74)make sure you use the .docx MS Word format, which seems to work the best in conversion. Publishers will be expecting you to have a .docx file somewhere anyway, so it’s best not to rock the boat. Pandoc is a command-line tool, but don’t be scared because it’s pretty easy to use. A typical command looks like this: Obviously pandoc is the command, but next up is the .docx file you want to convert <i>from</i>.…

In addition to the built-in export formats, installing the ox-pandoc extension will give Org access to the excellent Pandoc utility (http://pandoc.org). This expands the available outputs to other lightweight markup languages (for example, AsciiDoc or reStructuredText–see LXF212), slide deck formats (like the aforementioned slidy), and office formats (most notably .docx). In order to use it, first install Pandoc on your system if you don’t have it already. In an Ubuntu-based system, you can install the version from the repos with the following: Then, install the ox-pandoc extension from the repositories. Calling up the package list as described earlier and paging down, you’ll find it among some other “ox-” (which stands for “Org eXport”) packages that might be of interest. Once it’s installed (don’t forget to make sure it’s loaded by…

Version: 1.43.27 Web: https://github.com/xintrea/mytetra_dev We would love to write endless praise for Akonadi, if only it didn’t crash from time to time, so in the meantime there is still a demand for a solid, stable and well-designed personal information manager (PIM) for Linux. Before taking MyTetra for a review spin, we Googled for existing PIM apps and after a while discovered that MyTetra may be not instantly the best, but it has some special features to offer and generally looks very strong. Good things spring out from the moment you use it. In our memory MyTetra is the first app that asks if you want to store its data in ~/.config (standard behaviour) or in the current directory (portable version). The latter lets you take your notes with you anywhere…

All Swift versions come with a REPL (Read-Eval-Print-Loop), which is very handy for trying and learning new things because you do not have to create a source file, compile it and execute it – everything is evaluated after pressing the ENTER key, which means that errors will be revealed as soon as possible. In order to enter the Swift 4 REPL, you just have to execute swift, which will return the following: Please note that the Swift REPL supports auto completion, which means that if you type something and press the TAB key, the REPL will return all the available completions. This can come in very useful when you do not remember the name of a variable or a function that you want to execute. Figure 5 (final page) shows…

The internet joke is: I’ve installed Kali, now I’m Hackerman! Just having the tools doesn’t mean you’re an instant expert, but at least it’s a first step… This issue we’re taking our regular look into the world of hacking and we’re backing it up with Kali Linux on the disc alongside an in-depth look at the core tools you’ll need inside the magazine. We’re not promising to turn you into an expert (white-hat) hacker overnight, but we can at least set you off on the right path. We’re also keen to get you started with Linux, if you’re not already using it. With this in mind, on the DVD we’ve put the latest release of the cool Feren OS. Based on the popular Mint, it has a classic-styled desktop that…

Vulkan, the cross-platform graphics and compute API, is growing in popularity. Part of its success is down to its low-overhead nature that enables developers to bring advanced 2D and 3D effects to a whole range of devices. Now there’s a suggestion that Google is planning to implement the Vulkan backend for the Skia graphics engine of its Android mobile operating system. While it won’t appear in the current Android 9 Pie release, it could make an appearance in Android 10 Q (Quiche?). As the XDA Developers website reports (http://bit.ly/LXFVulkanAPI), the evidence that this could be happening stems from a comment by a Google engineer on the Chromium Gerrit. The comment (which can be read at http://bit.ly/LXFVulkanChromium) suggests that in the future there “will be a requirement” for Vulkan API support…

NETRUNNER 2018.08 A new snapshot from the Manjaro-based Rolling edition of Netrunner can now be downloaded and installed. It comes with updated KDE Plasma packages, upgrades to the Krita drawing app and introduces seamless GTK apps that look fantastic with the Plasma desktop environment. The Linux kernel is now 4.17, and there are also updates to Qt 5, Firefox Quantum, Thunderbird and much more. Check out the release announcement at http://bit.ly/LXFNetrunner. OPNSENSE 18.7 This specialist operating system for firewalls and routers is based on FreeBSD, and the latest release includes better IPv6 support, improved routing, a backup framework that includes Nextcloud as an option, and can now boot from a ZFS root volume. If you use OpenVPN you’ll be pleased to see default setup improvements for IPv6 and RADIUS attribute…

Appeal to your audience Advice for getting makers to attend your Jam. Recently, I’ve noticed a worrying trend: a decline in the number of people visiting my Raspberry Jam (http://blackpoolraspberryjam.co.uk). While this makes me sad, it also drives me to try and solve the problem. So let’s look at the issues and work out how we can fix them, and help any LUG or Jam promote themselves. Advertising via social media is free and easy, but are you reaching your target audience? Have you advertised in your town? Libraries, schools and community notice boards are great places to advertise. An A4 poster can be easily created using Inkscape and then printed ready for use. Or you can send the poster as a PDF to locations that can print off the…

The BlueTooth Blues Q Suckered in with your tantalisingly good Bluetooth speaker offer, I’m pleased to say I’m now a fully paid up LXF subscriber. I’m thrilled, the speaker works perfectly with my phone, so I can annoy people in the park with my eclectic musical tastes. I also enjoy having access to the subscriber archive, such a treasure trove of information. I’m interested in Raspberry Pi projects, so I picked myself up a Pi 3, but I’m having difficulty getting the soundbar working nicely. Sound is choppy, particularly from YouTube. It sounds like the machine is struggling to keep up, but I was under the impression the Pi 3 was reasonably powerful. I was feeling pretty pleased with myself, as the device wasn’t working at all initially. I’d try…

We’d love to try and answer any questions you send to lxf.answers@futurenet.com, no matter what the level. We’ve all been stuck before, so don’t be shy. However, we’re only human (although many suspect Jonni is a robot), so it’s important that you include as much information as you can. If something works on one distro but not another, then tell us. If you get an error message, please tell us the exact message and precisely what you did to invoke it. If you have, or suspect, a hardware problem, let us know about the hardware. Consider installing hardinfo or lshw. These programs list the hardware on your machine, so send us their output. If you’re unwilling, or unable, to install these, run the following commands in a root terminal and…

Audacious maintains answers to a few common problems that you may experience when using the app, but for all other queries and advice related to the software itself, or any of its plugins, you must turn to the official forums. Banshee features an FAQ covering a range of topics, such as its myriad features, supported hardware, configuration files, library database and so on. If your specific query isn’t already addressed, though, you can turn to the official forums. Although there’s no FAQ or user guide, Clementine’s GitHub page hosts a sparsely populated wiki, covering installation and basic usage. For specific assistance, you must join Clementine on Google Groups to connect with the user and developer community. You can also connect with the team of developers using IRC at the #clementine…

The infinitive ‘to hack’ has been co-opted by popular media as the act of illicitly gaining access to systems and exploiting them, either for personal gain or just for entertainment (lulz). However, the original hackers were just enthusiasts interested in making and meddling with technology in order to make things behave in new and novel ways. Many programmers and makers will happily refer to their day-to-day activities as hacking, but they’d probably use a different word if they were talking to, say, someone at border control. So do forgive us if we’re leaning more toward the media’s definition here. We just really liked the 1995 movie starring Jonny Lee Miller. And also the inspiring story of astronomer Clifford Stoll, who in 1986 almost single-handedly tracked down a hacker who was…

Once you’ve got it installed, you can fire up Metasploit with a simple msfconsole . It’s a text-only affair, which will make you look like even more of a l33t hax0r type. Metasploit features a hierarchy of modules sorted into categories such as auxiliary (things like port scanners and fuzzers), exploits (code for exploiting vulnerable systems) and payloads (things to execute on a remote machine that has been pwned by an exploit). Third-party modules can be added to the directory ~/.msf4/modules. Modules are written in the Ruby language and there are thousands available online. In the main text you’ll see how to run a portscan with Nmap, but there’s a Metasploit module for this, too. Using it will give some hints as to Metasploit’s usage in general. First load the…

Back in early January, just as LXF Towers was coming back to life following the winter break, stories began to break about a pair of far-reaching CPU vulnerabilities. As we rubbed our collective bleary eyes, unsure if we were still sleeping off those festive excesses, more details began to emerge: 20 years of chips from Intel, AMD and ARM were affected, there would be no simple remedy, patches were not ready. Spectre and Meltdown, as they were termed, had been kept under wraps for months while researchers scrambled to put together a fix. Spectre abuses a CPU feature known as branch prediction, which speculatively executes branches of code even though the results may not be required. The idea is if those results aren’t needed then they can just be thrown…

OUR EXPERT Sean Conway just retired from a 37-year career that spanned electronics and information technology industries. Now he will have more time to dabble with Pis and write about it. Early warning systems provide alerts to pending issues so immediate action can be taken to prevent or reduce further damage. ‘Honeypot’ is a term assigned to a computer system designed to detect unauthorised access to the resources it makes available. Honeypots are configured to look like legitimate computer resources on a network. The computer can be posed to look like a fileserver containing data that would have appeal to an attacker. A honeypot webserver, a honeypot database or a honeypot application server would have resources staged as bait to attract the adversary. When the attacker tries to gain access…

OUR EXPERT Nate Drake has a particular affinity for the Fighting Fantasy game book, Creature of Havoc. It concerns an unidentified beast with no concept of who or where they are… The steps for this project have been partly adapted from the official wiki for the RetroPie operating system, available at https://github.com/RetroPie/RetroPie-Setup/wiki. Anyone growing up in the past 30 years is likely to feel a twinge of nostalgia when remembering playing such classics as Super Mario Bros, Pac-Man and Street Fighter. Some readers may even have been fortunate enough to own their own games console, while the rest of us had to be content with pumping coins into any arcade machine (Pheonix arcade table at the Wigan Berni Inn–Ed) they could get their hands on. Using the RetroPie distro, your…

OUR EXPERT Nick Peers has a decade’s experience dabbling with Linux in general, and Ubuntu in particular. When it comes to wireless communication to and from your PC, it’s easy to overlook Bluetooth. Yet its low-power requirements make it ideal for all wireless scenarios, not least hooking up wireless input devices to your PC. Why clutter up your USB ports with wireless adapters for keyboards and mice when you can pair them with Bluetooth, for example? That’s not to say Bluetooth is perfect – far from it, particularly where Linux is concerned. Bluetooth implementation is improving and becoming easier to manage, but it can still fall over at the slightest provocation, particularly when attempting more complex tasks like streaming audio or sending files to and from mobile devices. We’ll not…

The default gnome-bluetooth GUI is adequate for basic setup and configuration of your Bluetooth-connected devices, but if you want full control of your Bluetooth setup and devices, install bluemanmanager ( sudo apt-get install blueman ). This provides more of everything, but requires a bit more work with certain features. That said, you get more detail about each connected device including signal strength and transmit level, plus a wider range of options such as being able to mark devices as trusted or untrusted, making it easier or harder for them to connect as required. Choose View>Local Services>Transfer and you can tweak the settings for receiving files from Bluetooth devices. This includes changing the folder that files are saved to by default, and automatically accepting files from trusted devices. Switch to the…

Don’t rely on good ebook readers to test your formatting, as they will flatter you and hide your flaws. Rather, test your formatting on terrible ebook readers. If you can get your ebook to look right on one of these, it will look right on anything! If you move your cursor to somewhere in Book View, you’ll see the code for it by selecting Format and then Show Tag. HTML is easy to get into, and most things just happen between an opening tag like <html> and a closing tag like </html>. Browsing the code from a few basic websites should give you a general idea of how it works. If you’re interested in learning more, visit www.w3schools.com  for free lessons.…

OUR EXPERT Aaron Peters wishes he was a programmer, but sadly has to settle for telling programmers what to do in the form of software documentation. Linux users should be familiar with the name Emacs because it’s one of the most venerable of Linux text editors. The debate between Emacs and VI(M) users is one of the all-time great flame wars (see Administeria p76), pre-dating KDE versus GNOME or SysInit versus Systemd. One of the pros (or cons, depending on which side you’re on) is that Emacs is a digital multi-tool, an operating system with a built-in text editor. Some users appreciate this all-in-one approach. Org-Mode will appeal to these users, because it’s also versatile with many features. While it’s not technically part of core Emacs, it’s been pre-installed in…

OUR EXPERT Dr. Sinitsyn A cloud infrastructure developer at Yandex by day, an open-source contributor by night, with interest in everything from AH to X509. Back in 2016, Linux turned 25. And now, while I’m writing these words, FreeBSD is celebrating a quarter of the century as well. Some of us prefer to think of FreeBSD as a younger brother to Linux (some do the opposite), and if this isn’t proof, what more do you want? You may have also heard that BSD is a “real Unix”, while Linux is just “Unix-like”. This is not strictly true. The list of official Unices is maintained by The Open Group, and it doesn’t include either Linux or BSD; but macOS is in, however. Yet nobody would argue that BSD has roots deep…

Today’s networks are rather chatty creatures. My idling Linux laptop observes a few hundred packets every five seconds. Imagine what a busy server connected to a high-bandwidth datacentre network sees! Capturing all packets in these situations would be quite impractical. That’s why most sniffers implement some filtering language to narrow the search. A de facto standard here is the so-called BPF filter. The name is slightly misleading: Berkeley Packet Filter (BPF) is really a low-level Assembler-like language. Yet ‘BPF filter’ typically refers to a high-level mini-language implemented in libpcap as described in the ‘pcap-filter(7)’ man page. BPF filters, however, are not the same as display filters in Wireshark, although it supports the former as well (they’re called ‘capture filters’). Recent versions of ‘Scapy()’ accept BPF filters as a ‘filter’ keyword…

OUR EXPERT Mihalis Tsoukalos is a UNIX person and the author of Go Systems Programming and Mastering Go. You can reach him at mtsoukalos.eu and @mactsouk Swift’s history is short – it was first introduced back in 2014, but it will most likely play a key role in the near future. Currently, the Swift programming language is changing very rapidly. This tutorial is about the features of the latest version of Swift, as announced last year at WWDC 2017, and will try to cover the most important and useful new features of Swift 4 using small, yet autonomous, programs. In order to get the most from this tutorial you will need to read and understand its contents and try to apply what you have learned in your own Swift 4…

The ‘Optionals’ type is a very interesting Swift 4 feature that allows you to deal with the absence of a value. The possible values of an ‘optionals’ variable are ‘None’ and ‘Some(T)’, where ‘T’ is a value of the correct data type related to the variable – this means that the possible values for an ‘Int’ optional are ‘None’ or an ‘Int’ value. When a variable is defined as optional, you will need to unwrap it in order to use it. The unwrapping happens with the use of the exclamation mark. The following interaction with the REPL will clarify many things about Optionals: First, you define an optional to an ‘Int’ – the value of the ‘optInt’ variable at this point is ‘nil’. Then you assign a value to it…

Open source projects are often less constrained by financial targets than their commercial cousins. Yet it also means that raising funds to keep such projects going can be a difficult process. Recently, we’ve seen a number of high-profile projects encounter funding issues, leading us to wonder if this is an unfortunate coincidence or a worrying trend. Liberapay, a non-profit alternative to Patreon that enables people to make donations to content creators, artists and projects, has revealed in a blog post (http://bit.ly/LXFLibPayFund) that it’s in trouble. The issue is that Mangopay, the payment processing platform that Liberapay uses is, according to the blog, “throwing [Liberapay] out”. The blog continues that Mangopay hasn’t explained why it’s decided to kick Liberapay off its platform, though it does speculate that the open nature of…

“Recently, The Linux Foundation launched LF Energy (LFE) to speed decarbonisation and accelerate the energy transition globally. The role of LFE is to help grow the community to build and support a common suite of tools, platforms, APIs and digital infrastructure extending across use cases in the energy sector. We’re organised around the goal of simplifying and standardising ICT for transmission, demand-side, generation, electric mobility and distribution markets. Because LFE is hosted at The Linux Foundation, we’re able to cross-pollinate with other industries and leverage their lessons learned through engagement with relevant open source projects. We’re working with the Core Infrastructure Initiative to ensure cyber-security is top of mind and baked into all our projects from the start. LFE is a neutral, collaborative environment that enables all stakeholders to deliver…

While Mozilla is supporting open source video codecs (see above), it’s also considering making a move that won’t be so popular: killing off support for RSS feeds and Live Bookmarks in Firefox. As ghacks.net reports (http://bit.ly/LXFRIPRSS) an entry was found on Mozilla’s bug-tracking website that states, “After careful consideration of various options (which also included doing nothing, or investing heavily in updating the code), we’ve decided to go ahead and remove built-in feed support from Firefox.” This suggests that the features will be removed in either version 63 or 64 of Firefox, which will be out at the end of 2018.…

“In Debian and derivative systems, there are many ways to build operating system images for Docker, virtual machines or embedded systems. The simplest tool of choice is often debootstrap, which works by downloading .deb files from a mirror and unpacking them into a directory which can eventually be chrooted into. However, more often than not, image customisation is required, with developers looking to install some extra packages, run a script, add some files and so on. Debosis a new, versatile image generator designed to make these types of trivial tasks easier. Written in the Go programming language, Debosworks using recipe files in YAML, listing the actions you want to perform in your image sequentially and finally, choosing the output formats. As opposite to debootstrap and other tools, Debos doesn’t need…

Alpinux, le LUG de Savoie Meets on the first and third Thursday of the month at the Maison des Associations de Chambéry, France. www.alpinux.org Build Brighton Thursday evenings is open night. www.buildbrighton.com Little Sandbox 5 Brasenose Road, Liverpool L20 8HL. Open maker night is Tuesday 6-9. Kids clubs are Monday (six to eight years) and Wednesday (eight to 12 years). www.littlesandbox.co.uk Leeds Hackspace Open night every Tuesday 7pm-late, open day second Saturday of the month, 11am-4pm. www.leedshackspace.org.uk Horsham Raspberry Jam Park side, Chart Way, Horsham. www.facebook.com/hackhorsham rLab Reading Hackspace Unit C1, Weldale Street, Reading. Wednesdays from 7pm. http://rlab.org.uk Huddersfield Raspberry Jam Meet every month at Huddersfield Library, typically the fourth Saturday of each month. https://huddersfieldraspberryjam.co.uk Medway Makers 12 Dunlin Drive, St Mary’s Island, Chatham, ME2 3JE. www.medwaymakers.com Cornwall Tech Jam Second…

Q Another answer to Marcel Faust’s question from Answers in LXF239 is to install Samba and uniquely name the Raspberry Pi on the share. This will make it possible to be searched for from most operating systems. For example, it could share one directory read-only, with a status file including IP address and anything else you fancy (I use cron to keep this file up to date every minute). I have several Pis doing various jobs and this works perfectly. Mike Spiers, by email A This is a great idea, Mike. Samba isn’t everyone’s cup of tea, but it does have some hidden benefits. Here’s a one-liner that would generate such a status file: This doesn’t rely on fixed interface names, so it should work for wired or wireless connections. It…

Recently an after-dinner conversation dissolved into a discussion about upcoming writing assignments for LXF and this author informed fellow LXF scribe Mayank Sharma about the possibility of doing a Roundup of music players. “But do people even still use music players?,” asked the senior Sharma in surprise, elaborating that with the advent of streaming services, and the readily accessible Internet radio stations, perhaps there weren’t any takers any more for such applications. “What do you expect people to do with all their music files then?,” asked this smug-looking author, thereby winning the argument. Which was a lot of fun, and very easy. At the very least, those two adjectives best describe the perfect music player. The best bit about all of these desktop applications is that they provide immediate access…

Users have a choice of many different online music stores nowadays. But many commercial services restrict their offerings in certain countries and territories, so this is one test which may not be relevant to all users. Audaciousand DeaDBeeFdon’t support any online stores, so you can’t import files from your account on any of the services. If you’re a fan of the Amazon MP3 service, you can import your purchased music into Bansheewithout expending much time and energy. The functionality is offered through a plugin, which is enabled by default – the app has consistently offered this service for the past several years and releases. Unfortunately Banshee doesn’t support any other commercial stores. Depending on your distribution of your choice, you can also install some community-driven extensions for Jamendo and Magnatune.…

We’re short on space and don’t like spoiling surprises, so we’ll leave most of the vulnerability discovery and exploitation to you. But to whet your appetites, let’s have a look at that IRC daemon that’s running on port 6697. If you have a nosey around the Metasploitable VM (in the /opt/unrealircd/ directory), you’ll find that we’re running a version of the Unreal IRC daemon from the 3.2 series. That’s a little bit like cheating, but if you want to be proper about this connect to the virtual machine with any old IRC client and you’ll find we’re running 3.2.8.1. It so happens that this particular version of this shipped with a backdoor (CVE-02010-2075), and it so happens that Metasploit has a module for exploiting said backdoor. To launch it and…

OUR EXPERT Les Pounder is a freelance maker who works with organisations such as the Raspberry Pi Foundation to promote maker skills. Read his blog at bigl.es As Linux users we’re pretty savvy. We know the benefits of SSH over telnet. We use VNC rather than RDP. But if you’re new to Raspberry Pi then chances are that you’re also new to Linux. So in this tutorial we’ll look at how we can connect to our Pi using Windows and Android devices. For all parts of this tutorial we shall be using the latest Raspbian image copied to a blank micro SD card using Etcher, downloaded from https://etcher.io. 1 Connecting to our Pi via SSH SSH – Secure Shell – is a secure method of remotely logging into a computer…

Canaries were used in mines as early warning system to detect dangerous gases such as carbon monoxide. Miners would take caged canaries into the mine tunnels with them. If the gas level in a mine reached a level where it impacted the canary, then the miners knew they were at risk, too, and would attempt to leave the mine – top fact the canaries were usually revived. The author’s spouse has a recreational vehicle trailer at a permanent camp site. Each year when she closes the trailer for the winter, she places a few peanuts in strategic locations. In the spring when she returns to open the trailer for the season, if the peanuts are gone she has confirmation there were rodents such as field mice in the trailer –…

No retro gaming experience would be complete without a controller. Obtaining controllers can be easier or more difficult, depending on how authentic you wish your experience to be. If you simply want the approximate look and feel of your childhood gaming experience, Amazon and eBay sell a number of PlayStation/Sega/Nintendo-style USB controllers, such as the Buffalo Classic USB Gamepad. If you already have an original controller, you may prefer to buy a USB adapter, so you can plug it into the Pi. Some, such as the Mayflash Dual SNES Controller Adapter, accept two controllers. This might put too great a strain on the Pi’s USB ports, though. If the second controller isn’t detected, try using a mains-powered USB hub. If you add a second controller, it should automatically set up,…

OUR EXPERT Shashank Sharma is a trial lawyer in Delhi and avid Arch Linux user. He’s always on the lookout for geeky memorabilia. Along system monitor statistics about the CPU and RAM usage, most users are quite fond of checking the weather forecast for their city. Most desktop distributions feature a graphical tool – Gnome’s Weather is one such popular application designed for the Gnome desktop – but there are several others. For users who would rather see this information in a dedicated tab on their Bash terminal, there’s no better alternate than Wego. As the name suggests, the utility is written in the Go language, and Wego has no other dependencies. It uses ASCII art to display the weather forecast icons such as Cloudy, Humid and Mostly Cloudy. Even…

Plugged in a generic Bluetooth adapter and want to check its capabilities? Simply type btmgmt info into a Terminal window to find out. Note the version number corresponds to its HCI version. In writing this article we started out with an older Bluetooth 2.1 adapter – it worked, but was a little glitchy. By contrast, we enjoyed more success with a newer Bluetooth 4.0 model, particularly with its audio quality. Type sudo nano /etc/bluetooth/ main.conf to access the main Bluetooth configuration file. Most options are commented out, but are accompanied by explanatory descriptions. To tweak Bluetooth’s audio setup it’s sudo nano /etc/bluetooth/ audio.conf.…

Advice on ebooks can be pretty shambolic. The closest thing you’ll find to a written standard is the Smashwords style guide. For the uninitiated, Smashwords is a company that takes your ebook and markets it across all major platforms for a fairly modest commission. Therefore it’s in its interest that you get your formatting right so it can do what it does without having to fix your book. It has a 117-page style guide (www.smashwords.com/books/view/52) that goes through all the major formatting points so that your ebook will be accepted on every platform. The more basic your formatting, the more easily it can be converted between formats, and the more errors you’ll avoid. If you can work through this enormous list, your book will be in the best possible shape…

Emacsmaps commands to a series of keystrokes, and sometimes that series is long. For example, the command for org-togglecheckbox (which toggles the state of Org-Mode’s checklist-style lists), uses the combination Ctrl+C, Ctrl+X and Ctrl+B. Yes, you read that right – this is three commands to accomplish one thing. If you try to memorise all these keystroke commands before diving into Emacs, it’ll be a long time before you can get started! Fortunately there are a few key combinations that provide the basics, as follows: Ctrl+X, Ctrl+F Called find file, it’ll prompt you to enter a file path. If a file exists at that path, then Emacswill open it; if not, Emacs will create it for you. Ctrl+X, Ctrl+S This keystroke will save the current file. Ctrl+X, Ctrl+C The combination to…

Back in June 2018 people were celebrating the 25th anniversary of FreeBSD, and here I am making jokes on flame wars in the Free Software community. But does it really have to be this way? I don’t know about you, but I mostly stopped reading comments on the tech resources I visit. The reason is nobody seems to care about the story itself, but only the proper nouns within. The rest of the discussion boils down to whether we need <insert project name here>. If you think it’s just simple Internet trolling, I can’t fully agree. For some reason, our community seems to encourage such ‘competition’, at least in my vicinity. While I also welcome the competition per se, as it leads to better products, this is not that type…

People tend to use a myriad of tools to troubleshoot their networking problems. Ping for simple connectivity checks, traceroute and tracepath for hunting faulty hops, tcpdump as a sniffer. Is Scapy a Swiss Army knife which is going to substitute them all? Well, not exactly, but it can try. Having Scapy in your arsenal doesn’t mean you oughtn’t to use any other tool, but issuing subprocess. Popen() every time you want traceroute, then parsing back the result doesn’t sound great either. Instead, Scapy reimplements (or wraps) many popular networking tools and provides them ready to use. Take scapy.utils.tcpdump() . This function accepts a packet list (captured, generated or else), sends it to tcpdump (or, alternatively, tshark) command and gives you back the results. Internally, the packet list is converted to…

The web site of the Swift programming language is https://swift.org/ . You can find more instructions and information about the available Swift 4 versions at https://swift.org/download/ . Learn more about Swift 4 by reading its documentation at https://swift.org/ documentation/ Swift Forums ( http://bit.ly/swftfor) is  the best place to learn more things about Swift 4, including the development and the implementation of Swift (http://bit.ly/swftdev),as well as its evolution (http://bit.ly/swftevo). Swift Forums is even suitable for newcomers Although Swift 4 is a fantastic programming language, it might not be the perfect choice if you want to write Linux command line tools. So, if what interests you is Systems Programming using a language other than C or Python, then you might…