Índex per July 2019 a Linux Format

Jonni Bidwell I remember getting a bootblock virus called Lamer Exterminator on my Amiga 500. It was notable because it could persist across warm reboots, infecting whatever floppy disk you booted next. This particular variant didn’t do any real damage – it just blanked the screen until an awkward key combination was pressed. Nick Peers So far, touch wood, the only experience of malware I’ve had has been with Windows machines. The tales I could tell, if I hadn’t blanked out the horror… although these days it’s the false-positives that are more disrupting than actual malware. With behavioural threats starting to outstrip bog-standard malware, is anyone truly safe? Les Pounder I once ran a WordPress server on Ubuntu 14.04 and it fell prey to a few issues: bad plug-ins, user…

Red Hat Enterprise Linux 8, the Linux distro aimed at businesses, has been released. The latest version, the last before Red Hat joins IBM after the latter bought it for a staggering $34 billion, has been “redesigned for the hybrid cloud era and built to support the workloads and operations that stretch from enterprise datacenters to multiple public clouds,” according to the press release (http://bit.ly/LXF251RHEL8PR). As part of this release, Red Hat Insights is being included as “Red Hat’s Linux expertise as-a-service,” which uses predictive analytics based on Red Hat’s knowledge of open source technology to help administrators identify and fix IT issues with the minimum of downtime. Red Hat Smart Management is also introduced in RHEL 8 as an add-on for the distro, which will make it easier for…

“The expression “What could possibly go wrong?” typically introduces a catalogue of disasters that adequately – and often embarrassingly – answers the question. In this case, it’s Mozilla with egg on its face. Thanks to the expiration of an intermediate certificate, a large number of Firefox extensions stopped working at midnight of 3 May. Easy to fix the technical problem: issue a new certificate. Not so easy to fix the reputation problem, though. It’s also easy to prevent the problem occurring in the first place. I’ve written before about the need for comprehensive monitoring of a business IT infrastructure. In today’s environment, that’s a requirement rather than a nice-to-have. Coupled with the monitoring is the need to have both someone motivated to take action when problems are reported, and a…

During an an interview at the Open Infrastructure Summit, Mark Shuttleworth revealed that Canonical, the company behind the Ubuntu distro, had seen an unprecedented growth of companies signing up for Ubuntu desktop support contracts. “They want to have fleets of Ubuntu desktop for their artificial intelligence engineers,” Shuttleworth admits. “We’re starting actually now to commercially support the desktop in a way that we’ve never been asked to before,” he added. “Previously, those were kind of off the books, under the table. You know, ‘Don’t ask, don’t tell’ deployments. But now suddenly, it’s the AI team and they’ve got to be supported.” While surprising, it’s certainly good to know that companies are making sure that their employees who use Ubuntu have official support. You can view a video of the interview…

“A new speculative execution side-channel vulnerability has been disclosed, known as MDS, which stands for Microarchitectural Data Sampling. This time, it impacts structures within Intel CPUs that track stores (writes) and loads (reads) to and from memory. The basic issue is that these structures can contain stale data from previous CPU operations. Under certain conditions it could be possible to use a cache side-channel attack similar to Meltdown in order to sample some of the left-behind data. Then, using sophisticated analysis, an attacker may be able to stitch it together. The kernel has been modified to add a mitigation for MDS that flushes out stale values left behind in the buffers of impacted CPUs. This mitigation is enabled automatically at boot time if it is required (depending upon the processor),…

Upgrading Shotwell Q I tried to apply Nick Peers’ piece on Shotwell to upgrade my version of it. I have Debian 8 Mint on a 32-bit machine. Shotwell is version 0.20.1-1 and I have been unable to upgrade as the PPA is not recognised in Debian. Am I stuck on 0.20.1-1 unless Debian adds a later version, I buy modern 64-bit kit or change to Mint or Ubuntu? It has to be said that Shotwell 0.20.1-1 works fine for me, but it’s not the latest and now that Peers has told me…! John Welford A Debian 8 (Jessie) is the old, stable version of Debian. It will only receive updates to handle security issues and bugs, not version bumps. That leaves two options: installing from a PPA or from source.…

Some tasks are just quicker and easier using the command line, as compared to navigating a GUI. One of the reasons some users avoid using the command line is the need to type in long commands and filenames; it’s time-consuming and error-prone, especially if you are a useless tpyist (ha!–Ed) like me. In such circumstances, clicking a name in a file manager becomes more appealing – but there is an alternative: Tab completion. When you press the Tab key in a shell, it tries to work out the rest of the word for you and add it. If this is the first word on the command line, the shell will search the path for matching commands and complete that. After the command, the shell will try to complete using files…

Brazilian boots For more than ten years I’ve been a happy Linux user. Not only am I glad to escape all sorts of bad habits from Microsoft, but I regularly help other people to adopt Linux. One of them is about 80 years and switched to Linux without a problem; another was a young girl without any special inclination for computers and has now been using Linux for many years and even prefers it to… an iPad! Recently a friend who lives in a rural area of Brazil came to stay for a few days; she told me that she’d left her computer in a shop for a hardware issue. When they returned her PC, Linux was gone and Windows had been installed. We decided to buy an inexpensive Dell…

Being a regular reader, you’ll know full well that Linux isn’t the only open source operating system that you can pluck from the internet for free. Notwithstanding our love for Linux, we do regularly review other open source OSes as well, particularly the BSDs. Many non-Linux open source OSes are designed for niche uses and wouldn’t be of much use outside their specialised environments. While they might not possess the dexterity of Linux, which can scale from your netbook to a server farm, a few of them perform quite well in multiple environments, including the desktop. We’ll introduce you to some of the best options for everyday desktop tasks in this Roundup. Despite the fact that they’ve been under development for over two decades, many of these alternative OSes are…

Another aspect that keeps these OSes from becoming mainstream is their lack of hardware support. On the other hand, on compatible hardware most of them will outperform your favourite Linux distro. For instance, Visopsys can power a graphical desktop from any Pentium computer with 64MB of RAM. The OS supports all variations of the FAT filesystem and has read-only support for ext4. In terms of peripherals it supports PS/2 and USB input devices, IDE and SATA disks, and PCnetEthernet cards. Similarly, you can run ReactOS on any Pentium-class x86 machine with just 256MB of RAM. ReactOS collaborates with various other projects such as Haiku for its hardware support, which is still fairly limited in comparison to some of the other OSes in this roundup. KolibriOS isn’t much different either. It’s…

LXF: The first Microsoft employee to appear in this fine publication (see LXF231) was Martin Woodward, who’s probably just down the road at Microsoft UK HQ as we speak. He’s the one that casually shifted hundreds of thousands of Microsoft developers onto a single Git-based platform. He made a joke about how simple it would be for someone to add UNIX line-endings to Notepad, and then six months later, lo and behold it happened. Does he have some kind of a superpower? JT: That may be accurate! When I was at Docker I was part of early conversations with Microsoft about Hyper-V, and it was apparent that a lot of the folks I was talking to saw where things were moving to. They were asking “How can we make our…

One reason to move away from X is security. By its design, any application can read output from or send input to any other. This means writing keyloggers and other naughty things is trivial – see our malware feature on page 32. Wayland has a much more robust security model which forbids this. Unfortunately, this frustrates traditional approaches towards simple tasks like taking a screenshot, as well as complicated ones like connecting to a desktop remotely. Some screenshotting tools still won’t work with Wayland, but the one bundled with Gnome does. We noticed that the option to capture a region seems to have disappeared from KDE Plasma’s Spectacle when running in Wayland, but otherwise it worked well. It’s taken a while, but remote desktop-ing (and screen casting/sharing/recording) functionality has been…

We’re taking a somewhat different tack for this tutorial. We’ll be learning about the binary numbering system and using Python to build an LED 8-bit binary counter. In digital electronics, a binary number is a base-2 numeral system that uses two symbols, zero and one. By comparison, the decimal number system requires ten different symbols or digits: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9. In digital electronics this is called the base-10 numeral system. In either base system, the symbols that are used to denote a number take on a different place value depending upon their position. Using the decimal numeral system, the number 114 represents the sum of (1 x 102 ) + (1 x 101 ) + (4 x 100 ). The digit symbol 1…

The gopass audit command checks all stored credentials for common flaws and reports back if the passwords are too short, or are based on dictionary words. It will also report back all the login accounts that use the same password. You can also check your passwords against the https://haveibeenpwned.com database of leaked passwords with the gopass audit hibp --api command. The auto-complete feature usually makes working with command-line utilities a breeze. If you’ve followed the instructions in this tutorial, you’ll find that you can’t use auto-complete with gopass and must type in the complete directory name every time you use it. Thankfully, the tool itself provides a quick remedy. Run the echo “source <(gopass completion bash)” >>.bashrc command, followed by source .bashrc , and you’ll be able to use the…

One of the benefits of online calendars is that they’re backed up and available to sync across all your devices. But what if you don’t trust third-party providers? The solution lies in setting up your own calendar server. We’ve already seen how NextCloud users can link an account to GNOME Calendar, but what about a standalone solution? One option worth exploring is Radicale (https://radicale.org), an open-source CalDAV and CardDAV server. Packages are available for QNAP (look in the QNAPclub.eu repo) or Synology NAS drives (follow the instructions at http://bit.ly/lxf251radicale). Or you can manually install it on your Linux server through the command line – note you’ll need Python 3.3 or later (3.6+ recommended): $ python3 -m pip install --upgrade radicale $ python3 -m radicale --config “” --storage-filesystem-folder=~/.var/lib/radicale/collections Once done, simply…

‘Party’ and ‘friends’ are found on almost every screen in the Parsec server app. The reason is simple: not only does the software stream games to other computers such as the Raspberry Pi, it lets you join multiplayer gaming parties with online friends. As you’ll spot in the Account screen, there’s even support for the Discord voice and text chat system with Parsec. You’ll also spot the option to sign up to Parsec Warp, which adds a theme to the Parsec environment and gives early access to Beta features. Online multiplayer parties can be accessed via the Party Finder tab, where a collection of games can be found. Prefer to host your own party? Ensure you’ve enabled hosting in the Hosting tab, then click ‘Create a party’ in the Party…

In elementary maths, we’re taught that squaring either a positive or a negative number gives a positive result, so there is no such thing as the square root of a negative number. However, this is an oversimplification. The more accurately stated fact is that the square root of a negative number cannot be a real number – that is, any positive or negative fractional number. All this changes when we introduce i. The number i is defined as the square root of minus one. You might feel that it’s cheating to ‘invent’ the number i, but it has to be admitted that it’s no more cheating than to ‘invent’ negative numbers. The number i is called an imaginary number, and all other imaginary numbers are multiple of i – so,…

If you enjoyed learning about embedded computing with the Elegoo UNO Project Basic Starter Kit and want to learn more, you might be interested to know that the same company offers a more advanced kit that could teach you so much more. It’s called the Elegoo UNO Project Super Starter Kit and it costs about twice the price of the basic kit. For the ultimate in bare-bones embedded computing, forget about an SBC and use a single chip – for example from the PIC range of micro-controllers. Some of these cost just 60p. We said that embedded computing platforms don’t have operating systems, but at the top end they might. Devices such as set-top boxes, routers and other networking equipment, and medical electronics might well run an operating system. What’s…

Get the code! Head to: www. linuxformat.com/archivesto grab the code pack for this project. What’s a PEP 333? PEP is a simple and universal interface between web servers and web applications or frameworks: the Python Web Server Gateway Interface (WSGI). It ensures your server and apps work together and continue to do so over time and after updates. Nice. The best places to get more advice about Django are websites that relate to programming in Python. Some good examples are https:// realpython.com, https://www. freecodecamp.org and of course the Django documentation itself.…

Semaphore 2.0 is a Continuous Integration (CI) and Continuous Delivery (CD) tool that will make your life easier should you choose to spend some time to learn it. We’ll discover how to install the command line tool that enables you to work with Semaphore 2.0 from your shell, and present two sample projects: one for Python 3 and one for Go. However, Semaphore 2.0 has far more features than the ones presented here, as it can work with almost all programming languages and tools. If a tool is not available, you can always install it on the Semaphore 2.0 VM and start using it that way. Although Semaphore 2.0 is a commercial product, it is free for open source projects. The good thing is that open-source users do not have…

Does Linux need an antivirus? I was asked this by a reader and didn’t quite know how to answer. They were moving from a Windows background where standard practice is to constantly run anti-malware, as generally everything can be seen as a threat to a Windows user. Never did we need any less of an excuse to throw Jonni once more into the deep end, let him flounder around for a bit and see what nuggets of useful information he can drag back to shore. So that’s what Jonni’s been doing, trying his best to get his Linux boxes infected with all manner of online nasties, without much luck as it turns out. You can read his guide to Linux malware on page 32, and as we’ve often alluded to,…

During this year’s Google IO developer conference, Google announced that every Chromebook which is launched this year will be Linux-ready out of the box – which means you don’t need to fiddle around with any settings or third-party programs to get Linux working. According to Google, all you will need to do is open the Chrome OS app switcher and type Terminal into the search box. This will launch the Termina VM which begins running a Debian 9.0 Stretch Linux container. If you don’t want to run Debian, you can also use Ubuntu or Fedora, but those are slightly more complicated to get up and running. A useful sub-reddit, r/Crostini, has some hints and tips for running Linux on current Chromebooks – check it out at www.reddit.com/r/Crostini/. By making it…

The Pinebook Pro, a Linux laptop by Pine64 that will launch at $199, looks like it is edging ever closer to release. A new video (www.youtube.com/ watch?v=mj3_jMBlbxA) unveils the latest prototype, which comes with improved hardware that can handle 4K videos. The Pinebook Pro is made out of magnesium alloy rather than plastic like the original Pinebook, and has a USB-C port for data, charging and video out, as well as a range of usual ports. The processor is a Rockchip RK3399 with Mali-T860 MP4 graphics, 4GB of RAM (double the amount of the original Pinebook), 64GB eMMC storage, a 14-inch 1080p display and a 10,000 mAh battery. You can find out more about the specs of the device at: www.pine64.org/pinebook-pro/. As you can see in the video, the prototype…

MPEG-1 AND MPEG-2 MPEG-1 and MPEG-2 are video codecs that are used widely, but because they were proprietary software, many distros (including Fedora) did not ship with them. However, in a note (http://bit.ly/LXF251FedoraLegal) posted by Tom Callaway of the Fedora Legal team, MPEG-1 (H.261) and MPEG-2 (H.262) video implementations are now permitted in Fedora. So it appears that the patent constraints that plagued those codecs are no longer in use. PROJECT TRIDENT 19.04 This desktop operating system is based on TrueOS, and has been updated to 19.04. It uses features included in the FreeBSD 13.0-CURRENT branch, as well as the Lumina 1.5.0 desktop environment. According to the release statement (https://project-trident.org/ post/2019-05-07_19.04_available), there have been a number of important changes since the last version, such as rEFInd being incorporated into the…

Linus Torvalds announced the release of the 5.1 Linux kernel, noting that he had been “waffling” about the timing but in the end, nothing that came up had been big enough to cause a delay. The 5.1 kernel includes many new features, among them support for using persistent memory as RAM (rather than just as a backing for storage devices), a more scalable way to track changes to large filesytems, and comes close to completing the ‘Y2038’ preparation. “Linux has historically not had a scalable means to monitor for changes on a large filesystem.” With the release of 5.1 came the opening of the merge window (period of time during which disruptive changes are allowed into the kernel) for what will become 5.2 in another couple of months. Linus had…

OGGCAMP 2019 The “unconference” will take place on 19-20 October in Manchester, and right now the organisers are running a call for papers (CFP) for the main scheduled talk track. So if you want to talk to over 500 people about your specialist topic, get your paper in now! But fear not, the unscheduled tracks are still there and there will also be a kids’ track, where eager minds can learn to code and hack with Raspberry Pi and micro:bit. More details at https://oggcamp.org. PYCON UK 2019 This year is taking place in Cardiff from 13-17 September and is the main Python conference for UK Pythonistas. At PyCon UK you can take part in workshops covering the broad Python community – from embedded devices running MicroPython, to Python in the…

Q I want to wipe all the data from a partition so it can’t be recovered. What is the best way to do that from the command line? Leon Barnett A The answer rather depends on how securely you want to delete the data. Do you just want to make sure a casual user running testdisk can’t recover anything, or do you want to guard against more sophisticated data-recovery techniques? The simplest option is to use dd to overwrite the partition with zeros: $ dd if=/dev/zero of=/dev/sdXN bs=4M Make sure you give the correct device for your partition: dd has no hand-holding “Are you sure?” prompts, it just gets on with copying data. A somewhat more secure version of this is to use /dev/urandom instead of /dev/zero , to write…

Many of the OSes in this Roundup suggest that users first experiment with them inside the safe environment of a virtual machine. We heed their advice and run all of them inside VMs configured as per the specification mentioned on their respective websites, before subjecting them to physical hardware. Our intention is to hunt for an alternate OS that enables us to use the computer productively. Sure, we don’t expect to be able to stream games via Steam or watch movies via Netflix, but if they can play multimedia, browse the web, do word processing and such without throwing unexpected errors, they’ll be in our good books. We’ll test various parameters such as installation and app support, with the sole intention of helping us zero in on an alternate OS…

This Roundup includes operating systems that are called ‘alternative’ for a reason. They are unlike your everyday desktop distro and in fact it’ll be unreasonable to expect them to look, feel and behave like other mainstream OSes as well. Many of them are also in the nascent stages of development, despite the fact that developers have been working on some of them for over a decade. The early development stage is a reflection of the OSes’ unstable base, which will have a direct impact on their usability and performance. Even when it comes to mainstream distros, usability is an important factor for consideration. Having a long list of features comes to naught if a distro isn’t usable. The same is true for these alternate OSes. This is why in addition…

There are several other open source OSes that we didn’t include for one reason or the other. The most mainstream alternative is TrueOS, formerly known as PC-BSD, which is a desktop flavour of FreeBSD. There’s also GhostBSD for those looking for a MATE-based desktop. For fans of AmigaOS there’s Syllable Desktop, which wasn’t included as it hasn’t been updated for several years. Similarly, it’s been some years since the last release of MenuetOS, which is the progenitor of KolibriOS. The 64-bit version of Menuet had a release last year, but that version isn’t open source. Licence ambiguities also prevented us from featuring another AmigaOS clone, Icaros, which is based around the AROS Research operating system. We also couldn’t spot the source code repository. There are other AROS-based OSes, such as…

The Thycotic Black Hat 2018 Hacker Survey Report1 states that almost 60 per cent of hackers thought social engineering was the fasted way to pwn a network. Malware (6 per cent) and application vulnerabilities (20 per cent) apparently are much less likely to be used. Thanks to lax security practices and/or hacker ingenuity, there are considerably sized password dumps publicly available. You can check if any of your email addresses are associated with these dumps by visiting Troy Hunt’s https://haveibeenpwned.com. A password for an old forum you joined years ago may not be much use to a hacker, but if that forum account can be tied to your identity (via email address, username or otherwise) and you re-use that password or some trivial variation of it elsewhere, the game changes.…

Without some knowledge of memory management, pointers and execution stacks, it’s hard to give a rigorous account of how programs get compromised and thus enable malware to do its thing. This isn’t the time or place for such an in-depth look, but we can at least provide an only slightly hand-wavey account of one way a program might be exploited. Programs work with input, which might come from a user, a website, another program, a piece of hardware (like a keyboard or a sensor) or a file. For a program to work correctly, that input has to be correctly formed. If it’s not, then it won’t fit nicely into the memory allocated to it, and horrible things can happen. We’ll be more specific about what those horrible things are in…

As the world descends into geopolitical chaos, we hear more and more about the shadowy ‘cyber operations’ of nation states and the evil genius hackers that reside therein. North Korea, Russia, China and Iran have all been fingered by Western governments for various cyber-wrongdoings. The Wannacry ransomware, which was based around a leaked NSA exploit called EternalBlue, is generally accepted to have come from North Korea. This nearly crippled health services here in the UK, and could have been much worse had it not been for the deft work of security researcher Marcus Hutchins, who was able to analyse the malware and find a killswitch. Unfortunately Hutchins has recently pleaded guilty to wire fraud charges in the US dating from 2014, when he may have been involved in the shadier…

Designed to be the first contact people have with creating programs on a computing platform, Scratch is now at version three. This visually-driven programming language is included among other systems with Raspbian to run on the Raspberry Pi. Over the final full weekend of August 2019, the Scratch Conference Europe is coming to the UK for the first time. It aims to brings teachers, education professionals and volunteers together from all round the globe. It will be held in Cambridge – suspiciously also the HQ of the Raspberry Pi Foundation itself – at the Churchill College, Cambridge University. It’s bound to be a popular conference so ensure you get your tickets early to avoid disappointment. Things kick off on the afternoon of Friday 23 August with a showcase and networking…

Compiling Yocto images puts extreme levels of strain on your hardware and your net connection. When we started experimenting with Yocto, we purchased a high-performance workstation based on an FX8320 octa-core processor from AMD, along with 16GB of RAM and a 128GB SSD. When work on this tutorial started, the machine had about 90GB of free storage: when done, we were down to zero. RAM usage stayed below 8GB most of the time, however; having an additional 8GB made sense due to our penchant for playing around with virtual machines. Keep in mind that the Yocto build process is CPU- and disk-intensive, so running desktop applications while the process is taking place in an uncomfortable experience. This makes Yocto ideally suited as a stress-test for your hardware. If a workstation…

An IDLE session (Integrated Development and Learning Environment) is a simple shell environment packaged with Python that enables communication with the Python interpreter interactively. The console provides editing functions and enables the running of simple Python scripts. You can open an IDLE session by typing python at a command line interface console. The IDLE session enhances the text in different fonts to guide you. Inside the IDLE shell you can issue Python commands and have them executed by pressing Return. The Python interpreter reads the command and, provided it discovers no problems, a response will be delivered. Exit the IDLE environment by pressing Ctrl+D, or you could also run the exit() command followed by Return.…

One element missing from the default Calendar app is a to-do list manager. Instead, Ubuntu has a separate complementary app: ToDo. The program automatically pulls in to-do lists from calendars set up elsewhere on your system and makes it easy to add and manage new entries. Fancy giving the Lightning add-on a sleek new look? Use the Add-ons Manager to search for the Calendar Tweaks add-on. Once installed, it customises various aspects of the user interface automatically to provide a more modern look. All its settings can be customised further via Add-ons > Calendar Tweaks. If you’re looking to access a calendar from the shell, visit https://calcurse. org for details of the command-line calcurse app, which has all the key functionality you need as well as experimental CalDAV support.…

ISSUE 250 June 2019 Product code: LXFDB0250 In the magazine Get Linux on your Chromebook with our complete install guide. Plus check out our Roundup of rescue distros, tweak your Pi config to perfection, optimise Steam or ditch it altogether with Lutris, and meet the folks behind 64 Studio. DVD highlights Solus Linux 4.0 (64-bit) and Sparky Linux 5.7 (32- and 64-bit). ISSUE 247 March 2019 Product code: LXFDB0247 In the magazine Lock down Linux Mint 19.1 tighter than the ed’s wallet with our full guide to security. We take at look at the huge range of photo editors available in Roundup, show you how to get your head around Git, build a 2D platform game, and make your terminal talk. DVD highlights Linux Mint 19.1 Cinnamon 64-bit and Xfce…

The mathematics of fractal geometry is often referred to in the same breath as chaos theory. A chaotic system is one that exhibits super-sensitivity to initial conditions. Weather is an example, and its chaotic nature makes it impossible to forecast very far into the future. Forecasting involves measuring the current temperature, barometric pressure, humidity, wind speed and so on, and plugging these into a mathematical model that defines the Earth’s atmosphere. Needless to say there’s a limit to the accuracy of the instruments that make these measurements and, because the weather is chaotic, even tiny errors cause the forecast to deviate from reality at some time in the future. An illustration known as the Butterfly Effect suggests that a butterfly flapping its wings on Mount Fuji could, in the fullness…

We have some good news and some bad news. The good news is that software for many of the control applications you’ll be writing – at least initially – won’t be very complicated, so the likelihood of introducing programming errors is less than with many coding tasks. The bad news is that, if your software does go wrong, debugging code running on an Arduino SBC is tricky. In particular, the standard IDE does not provide facilities such as setting breakpoints, single-stepping, reading memory locations and so on. What is possible, however, is to use the USB link between the SBC and your PC – the same link that’s used for downloading code to the Arduino – to transmit data back to the IDE. This involves adding instructions to your code…

Django Packages (https://djangopackages.org) is a site where web developers and enthusiasts can share their tools and creations. Before you start any project, go there and pick the closest thing to what you are trying to create. These packages are not ‘approved’ by the Django project, but the code is still a great source of inspiration. One thing you can do with this code is to use it in your own projects. Even better is to download it and study it. Be aware that many projects are from some time ago, so they may not be painless to use. However, much of the code has been used, or is in active use, so just pay attention to the metadata about the projects, which shows things such as which Python version it…

You can learn more about Semaphore 2.0 by visiting www. semaphoreci.com. The documentation site of Semaphore 2.0 can be found at https://docs. semaphoreci. com. Lastly, you can learn about the pricing model of Semaphore 2.0 at https:// semaphoreci. com/pricing. Other CI/ CD software includes the likes of CircleCI, AppVeyor, Azure Pipelines, Jenkins and Travis. Even GitLab offers its own CI/CD functionality - you can find more information about it at https://about. gitlab.com/product/continuous-integration. YAML is a popular text-based format that is used for defining the Semaphore 2.0 pipelines. The single most important piece of advice when writing YAML files is that you should not mix spaces with tabs in the same YAML file. The second advice is that the cause of most problems in YAML files is wrong indentation. YAML files work with…

When you have some loose ideas that you want to play around with, start on the Colaboratory website: http://bit.ly/ lxf251colab.When your idea takes a clear shape, write it to GitHub, Google Drive or your local drive. Changing the framework in the middle of a project is so troublesome that it will delay or even derail the project completely. To make sure catastrophes like the one mentioned are avoided, the maintainers wrote a standard, PEP 333, in 2003. In 2010, they updated it for Python 3, PEP 3333.…

The designers of Flask decided early on that the framework itself would not have all the functions embedded. This philosophy is, of course, an extension of all open source work. When you start using Flask, you may be disappointed by this. Don’t be: the effect of this is actually empowering. You can very quickly learn how to use Flask and then expand it. When you feel that your project has gone beyond what Flask can handle, stop, think and look through https://github.com/humiaozuzu/awesome-flask for some amazing examples of what it can do. This is a long list of resources that includes extensions, tutorials and development tools of all sorts. The student who maintains the list updates it frequently, so the list is always fresh. It’s presented with categories so you can…

USING THE LXFDVD Using Linux for the first time can be very confusing. It’ll be unlike anything that you’ve likely operated before, especially if you’re used to Microsoft Windows or Apple macOS. Generally our DVDs are designed to be run directly, which is to say that when you first power on your PC (or Mac) it should ‘boot’ from the DVD – so before Windows or macOS even starts to load – with Linux running directly from the DVD. This trick is known as a Live Disc. It enables you to try out the various versions of Linux without having to install or change anything on your PC. Just remove the DVD, restart your PC and it’ll be exactly as you left it. While many systems will boot from a…

“After a year-long development cycle, the much anticipated GStreamer 1.16 was made available recently. With it came a number of exciting new features we’re especially proud of, including per-element latency tracer and support for planar or non-interleaved audio. We’ve added support for the next generation, royalty-free AV1 codec to Matroska and MP4 containers, which are the two main container formats used around the internet. The GStreamer WebRTC stack gained support for data channels for peer-to-peer communication based on SCTP in addition to the existing video and audio support. Closed captions, an important feature for accessibility, are now supported as a first-class citizen in GStreamer; this makes it possible to get those assistive subtitles embedded in TV streams. The Video4Linux encoder and decoders gain support for the HEVC codec, while the…

Mozilla’s Firefox web browser encountered a serious issue recently when an out-of-date certificate made all extensions unusable. The bug caused the software to view the extensions as incompatible, despite running without issue earlier. The problem was severe enough for Mozilla to rush out a fix, with the team tweeting that “So sorry for the issue we’re having with add-ons right now! We’re working hard to fix it and will keep you updated.” As promised, Mozilla released Firefox 66.0.5, which includes a fix for the issue.…

“Well, another month another critical processor vulnerability (with a catchy name) and, as a bonus, a flaw in Whatsapp that meant your phone can be hacked just by receiving a call. You don’t even have to answer it. Meanwhile, SIM swapping attacks (where mobile operators are tricked, bribed or otherwise coerced into porting a telephone number to a new SIM, undermining two factor authentication) are on the rise, and Google’s Bluetooth-LE Titan security keys can be hijacked by a proximity attack. In other news, Signalling System 7 (the protocols that connect mobile networks and have been around since 1975) can be attacked. So too can the Border Gateway Protocol (essentially a band aid applied to the Internet in the 90s), large swathes of the internet are regularly routed anomalously. It’s…

Laurent Dufour posted an updated (version 12) patch series titled “Speculative Page Faults” aiming to improve scalability for massively threaded applications. In spite of the name containing “speculative” this has nothing to do with security, but instead to do with speculating that other threads won’t be trying to set up a similar mapping at the same moment. A discussion is under way about ways to handle kernel live patching in the presence of LTO (Link Time Optimisation). LTO is a feature that enables a compiler to eke out further performance from binaries. It isn’t enabled in upstream kernels, but it is used by Android when compiled with LLVM. Alas, in its current form it is incompatible with live patching, without some work. Dmitry Safonov posted version 3 of a patch…

Build Brighton Thursday evening is open night. www.buildbrighton.com Cornwall Tech Jam Second Saturday of the month, alternating between Bodmin and Camborne. www.cornwalltechjam.uk Glasgow Makers and Hardware Hackers Mitchell Library, Glasgow. https://m.facebook.com/groups/115303729096198 Huddersfield Raspberry Jam Meet every month at Huddersfield Library, typically on the fourth Saturday of each month. https://huddersfieldraspberryjam.co.uk Horsham Raspberry Jam Parkside, Chart Way, Horsham. www.facebook.com/hackhorsham Leeds Hackspace Open night every Tuesday 7pm-late, open day second Saturday of the month, 11am-4pm. www.leedshackspace.org.uk Medway Makers 12 Dunlin Drive, St Mary’s Island, Chatham ME2 3JE. www.medwaymakers.com New Jersey Linux User’s Group Last Tuesday of every month, at Panara Bread, 165 Route 4 West, Paramus, NJ. http://njlnux.org PLUG – Perth Linux Users’ Group Once a month, at Spacecubed, 45 Saint Georges Terrace, Perth, Western Australia. www.plug.org.au rLab Reading Hackspace Unit C1, Weldale…

We’d love to try and answer any questions you send to lxf.answers@futurenet.com, no matter what the level. We’ve all been stuck before, so don’t be shy. However, we’re only human (although many suspect Jonni is a robot), so it’s important that you include as much information as you can. If something works on one distro but not another, then tell us. If you get an error message, please tell us the exact message and precisely what you did to invoke it. If you have, or suspect, a hardware problem, let us know about the hardware. Consider installing hardinfo or lshw. These programs list the hardware on your machine, so send us their output. If you’re unwilling, or unable, to install these, run the following commands in a root terminal and…

Send your thoughts to the Linux Format dungeon server at linuxformat@futurenet.com, be picked as Letter Of The Month and win* a 32GB Nitrokey Storage 2! The Nitrokey is worth a cool €149, has 32GB of hardware-encrypted storage, supports hidden volumes, secures your online accounts with onetime passwords, can encrypt emails, files and hard drives and is an open source, open hardware solution. Protected with AES-256 and RSA keys up to 4,096! Learn more at www.nitrokey.com.…

Besides the Gnome-based desktop editions, both Fedora and Ubuntu officially support spins based on various popular and upcoming desktop environments, including KDE, Xfce, LXQt, MATE, LXDE, Cinnamon and more. Additionally, there’s more to both Fedora and Ubuntu than just the desktop editions. Starting with Fedora 30, the project is combining its cloud and server efforts into the Fedora Server edition. There’s also a new variant of the workstation edition that uses the hybrid rpm-ostree packaging system and is aimed at developers, who will appreciate its ability to easily roll back from updates in case of any issues. Also part of the announcement is the (as yet unreleased) container-focused version of the distro called Fedora CoreOS. Also in the pipeline is an edition tailored for IoT devices. Similarly, Ubuntu puts a…

Because Visopsys is primarily designed for developers and students, the bulk of its documentation caters for this group. There’s a lot of information that exposes the internals of the OS, which is a treasure trove for any Computer Science student. KolibriOS also has just enough documentation to help users get started with the OS. There’s a quick FAQ and some how-tos to help boot KolibriOS alongside Windows and Linux, as well as on virtual hardware. There’s also a fairly active multilingual forum for dispensing help. OpenIndiana fares a little better. It has a detailed FAQ and an (under construction) handbook, which is still fairly detailed. There’s also a wiki to help users and developers get orientated with the OS. The project surprisingly doesn’t have a forum, so you’ll need to…

Linux is no place for malware! “Its small user base means no one’s interested in attacking it. The culture of downloading and running random stuff from the web doesn’t exist. It’s more secure. Ecosystem fragmentation works in its favour, making it hard to target a particular distro”, they bellow! Sadly, none of that is true. Linux servers run most of the internet, there are billions of Android phones, as well as Arm and MIPS-based routers and IoT devices. And people run things of the form curl… | sudo bash all the time – it’s the recommended install method for a number of popular programs. So the time for Linux complacency is over, and the time for long passwords, diligent opsec and paranoid rants by deluded technical editors is upon us.…

Drive-by downloads are pretty rare on Linux, and to be fair they’re becoming increasingly rare on Windows too. Gone, also, are the days where respectable programs bundled surreptitious ‘optional’ extras with their installers, such as browser search bars or spontaneous uncloseable popup adverts. But that’s no excuse for complacency. Where these kinds of things do appear on Linux, it’s usually in the form of browser extensions, which are usually installed unwittingly by users. The goodly humans and machine-learn’ed bots that patrol the Chrome store and the Firefox extension page can’t catch everything, after all. More often than not, these are easily uninstalled from the Add-ons (Firefox) or Extensions (Chrome/Chromium) preferences. Recent versions of Chromium can log all extension activity; just start it with: Then go to the Extensions page, hit…

James Turnbull is CTO of Microsoft’s Startup Advocacy team and a veteran of the open source world. He’s also a co-chair of the Velocity conference where, in October 2018, he was good enough to take the time to talk to us. This is his second time in Linux Format, having graced the pages of LXF194 while he was VP of Services at Docker. This time around he talked about his days as a Bash ninja, his work with educational start-up Empatico and, of course, the new, open-source-friendly Microsoft. Linux Format: How long have you been involved with the Velocity conference? James Turnbull: I’ve been coming to Velocity for seven years, I think. And I’ve been a Chair of the conference for about three and half years. LXF: So I get…

There are all sorts of reasons why you might not be able to start a Wayland session. Most commonly, it’s because you’re using the proprietary Nvidia driver – although this won’t be the case with a fresh install of Fedora, since Fedora doesn’t include any proprietary blobs. Recent versions of Gnome and KDE, from Plasma 5.15 on, actually do support the driver’s EGLStreams API (all the other drivers use GBM), but whether or not it works is going to depend a lot on your particular hardware and driver version. One solution is to use the free Nouveau driver, although this will not be ideal if you like serious gaming. A strange issue we witnessed on Arch Linux, using Intel graphics – which have supported Wayland for ages – was that…

The Raspberry Pi attracts a diverse range of people, from children to scientists and every walk of life in between. The Raspberry Pi has democratised access to computers. But what do we mean by that? Well, if we lower the cost of a computer then everyone has access to owning one. So for $35 we have essentially a low-power desktop computer. We can go on the internet, watch YouTube videos, send emails – all from this simple board. For some users this is where their journey will end, and they will simply use the computer as a computer. But for others they will use it to learn a new skill. Children will learn to code with Scratch, then progress to other languages, with Python being the most likely candidate due…

JSON is short for JavaScript Object Notation and was created as a lightweight data-interchange format that is easy for humans to read (easy for your to say–Ed) and write. JSON is an open standard and despite mentioning JavaScript in its name, it can be used with many different programming languages. When using Python we can read a JSON file remotely using requests. By printing the contents of r to the shell we see the entire structure of the JSON file, which is exactly the same as a Python dictionary. We then find the key for the value that we want to use. For example, we found the latitude of the ISS using: We can also create JSON in Python by creating a dictionary and using the json library to dump…

When optimising the bill of materials for a process computer system, opting for smaller memory card sizes always seem like a good idea. But reducing the amount of memory used in a process computer usually does not lead to significant cost savings. Three issues are responsible: first of all, permanently falling memory prices caused by Moore’s Law and semiconductor industry factors quickly diminish savings. Secondly, memory card cost is but a small part of the TCO. Optimising other parts tends to give significantly more savings: a good example would be switching the Raspberry Pi 3, which sets you back £35, for an Orange Pi, which can be had for much less. Finally, the appearance of a pesky customer asking for an extra feature after release is almost preordained. If your…

Mandelbrot might be a type of Jewish almond bread but, in the context of the Mandelbrot Set, it’s the name of Polish mathematician Benoit Mandelbrot, who studied it while he was a visiting professor at Harvard University in 1979. In his pioneering book The Fractal Geometry of Nature, Benoit Mandelbrot says that he coined the word ‘fractal’ from the Latin word ‘fractus’. The corresponding verb ‘frangere’ means to break into irregular fragments, two words which, Mandelbrot thought, appropriately described these strange figures. Creating images of the Mandelbrot Set had to wait until computing made it possible. When Mandelbrot first turned his attention to fractals in 1979, he needed a large VAX minicomputer, which he had to use at night when there was little competition for computing resources. Image quality, on…

The Arduino family – even if we only consider the official boards – is much more diverse than the Raspberry Pi family, and becomes even more so when we include third-party products in the mix. The names don’t really reflect where they are in the pecking order, though, so you’ll need to consult a comparison table to decide which one to use. Like SBCs that run Linux, Arduino boards are differentiated by the power of the processor and the amount of memory, but only to a degree. You might do better than the 16MHz 8-bit processor on the UNO, but you’re not going to find anything comparable to the Raspberry Pi’s processor, and only a few have more than 256KB program flash or 32KB RAM. For all but top-end embedded…

The Django web framework was named after the famous guitarist Django Reinhardt and was first created by web developers at a small newspaper in Kansas. The main goals of Django is to enable fast development of complex websites with database needs. It is very easy to get started if you have some Python experience; the package includes a simple web server and an optional admin interface. In the stable version (Django 2.2), you need to have at least Python 3.4 – it works well with Python 3.7.3. Do your best to stay at the highest stable version when you start a new project. Django always aims to follow the standards set in PEP3333, usually known as WSGI. Twang the Django The most obvious way to use Django is to create…

If you have a production machine and have problems with adding your virtual environment for any reason, you may want to use a service. One such is PythonAnywhere (www.pythonanywhere.com),where you can have two terminals and several files. The free version provides 512MB of storage and puts restrictions on the bandwidth and processing time you need. This makes it an excellent choice for testing your ideas before you start serving it as a real site. Terminals support Bash, Python and MySQL. With these, you can choose your Python environment and create Flask and Django projects to your heart’s content. Keep in mind, though, that you have a maximum processing time to contend with, so if you start testing CPU-heavy code you may run out quickly. With that in mind, you can…

Promotions are an advanced feature of Semaphore 2.0 that can also be found in other CI/CD systems. A promotion is just a way of manually or automatically triggering one or more pipelines from the current pipeline. The promotions property is used for defining promotions in Semaphore 2.0. The following part of a .semaphore/semaphore. yml file implements two promotions: What this YAML code does is to create two promotions in the initial pipeline. The first will be automatically promoted once the initial pipeline is successfully finished on the master GitHub branch, and the second should be manually promoted from the Semaphore 2.0 GUI. One example where you need a condition to automatically promote a pipeline is when you are building web sites with Hugo and you only want to auto-promote when…

When your project grows large enough, you may find yourself using components that are not yet in Flask but should be. When this happens, you can build an extension. Extensions add functions to Flask, or rather the possibility of using more functions. You can make an extension just to make your future work easier, or you can make it widely available. To make it publicly available, register it at http://flask.pocoo.org/extensions. Bear in mind that all registered extensions go through an approval process by the community. For this reason, make sure you register your interest to create an extension on the mailing list before you start – it will save effort in the long run for everyone. One of the main considerations of extensions is that they should be able to…

MAINSTREAM GNOME DESKTOP Ubuntu 19.04 ‘Disco Dingo’ 64-bit We were just in time to miss getting Ubuntu 19.04 on the disc last month, but better late than never, eh? There was a time when we’d make the cover more orange than the Netherlands on King’s Day whenever a new Ubuntu release hit the mirrors, but these days our celebrations are more tempered. The LTS releases are still a big deal, so expect to see lots of orange in our May 2020 issue. Since those long-term releases are shaped by these interstitial ones, they should definitely not be ignored. With that in mind, we’ve extended our DVD pages slightly to give you a glimpse into what’s new and what the ‘Disco Dingo’ can do for you. Ubuntu’s transition from Unity to…

READING MATTER Advanced Bash Scripting Guide Go further with shell scripting. Bash Guide for Beginners Get to grips with the basics of Bash scripting. Bourne Shell Scripting First steps in shell scripting. The Cathedral and the Bazaar Eric S Raymond’s classic text explains the advantages of open development. The Debian Book Essential guide for sysadmins. Dive Into Python Everything you need to know. Introduction to Linux A handy guide full of pointers for new Linux users. Linux Dictionary The A-Z of everything to do with Linux. Linux Kernel in a Nutshell An introduction to the kernel written by master hacker Greg Kroah-Hartman. The Linux System Administrator’s Guide Take control of your system. Tools Summary Overview of GNU tools. GNU Emacs Manual Six hundred pages of essential information! Producing Open Source…