Table of contents for March 2019 in Linux Format

Jonni Bidwell I like the olde fashion’d idea of just unplugging network cables. But setting up a Raspberry Pi VPN/Tor router is a less drastic way to frustrate any efforts to snoop on your comms. A little black magick goes a long way too, so venturing to the Otherworld and giving goblins shiny things might buy you some security. Matt Hanson Tor has always been my pick for a more secure Linux life, especially these days when it feels like everyone and their grandma is out there sniffing around our internet activity. Combine it with running Tails off a USB drive and I can safely remove my tinfoil hat while browsing. Nick Peers I’m exploring how to add 2FA to Mint. It’s technically possible, but you’re not adding an extra…

The European Commission has launched 14 bug bounties, encouraging people to find security issues in free software projects that EU institutions use. By highlighting these issues, so-called bug hunters can help make sure that no serious problems affect the software that EU governments rely on. The Free and Open Source Software Audit project (FOSSA, read more at https://juliareda.eu/fossa) has been running since 2015, and it’s now offering various rewards depending on the severity of the bug found, and in which open source software. FOSSA is offering up to €58,000 for bugs found in FileZilla and VLC, €89,000 for Drupal, €45,000 for GNU C Library and much more. Those high prices show how keen the EU is on finding any bugs in the software that it uses, and it should encourage…

“ Much to our dismay, it turns out that human beings aren’t perfect. Our brains do funny things and lead us to believe things that aren’t true. I suspect that you want an example to back up this statement. So, let’s examine the Dunning-Kruger effect, named after psychologists David Dunning and Justin Kruger. The Dunning-Kruger effect is a “cognitive bias in which people of low ability have illusory superiority and mistakenly assess their cognitive ability as greater than it is”. Or, in English, “How hard can it be?” “Low ability” doesn’t mean “stupid”. I have a low ability to ride a horse (let’s assume I’m not stupid). My reaction to my daughter having riding lessons is “how hard can it be?” After all, surely all that’s required is to sit…

“For many years, Linux version numbers meant a lot more than they do today. The first two digits were an indication of major feature changes and followed an odd/even pattern in which 2.5 was a “development” series kernel, while 2.6 was “stable”. In today’s git-powered world the numbers mean less. This is because the pace of development has shifted, from a multi-year development kernel followed by stable kernel release, to a few months at a time for the whole thing. Thanks in part to git, it’s possible to churn releases faster than before. I started using Linux in the 2.0 days, by which time it was already running on multiple CPU types. But there were many ways in which the Linux of those days was so different. For one thing,…

Patently useless I was wondering if the Microsoft patent release include patents on exfat, or are any of the patents that are actually useful to the people who can’t afford to pay? For example, people involved with the Samba project? pgmer, via email Neil replies It’s a good question and not one we’re qualified to answer. We do know there’s a sub-pixel rendering patent in there that the Fedora team is already using for improving text rendering, which is rubbish on Linux. Still open My understanding is that Libre Office was forked from Open Office. I still use Open Office 4.1.5 and I often want two documents side by side and it’s easy. Open the required documents. They will open in the same window on top of each other. Click…

Copying users Q I decided to upgrade from Kubuntu 16.04 to 18.04. I installed 18.04 on to a new SSD drive so that I could have the two OSes sitting side by side until I was happy with the upgrade. When I installed 18.04 I pointed the installer to the existing home directory on my hard disk, which has five user accounts on it. Everything installed as normal. However, when I started up 18.04 it didn’t detect the users on the old home directory. The only user available was the one that I specified during installation. My question is, what’s the procedure for restoring the old user accounts into the new operating system? Googling the issue I came across the statement that users must have the same UID/GID to access…

We often recommend using the shell to run commands on a Linux system. However, we understand that not everyone is particularly comfortable with using the shell, even though it’s a valuable skill to learn. There is a more universal graphical alternative. It’s called Webmin ( www.webmin.com ) and is almost certainly in your distro’s software repositories. As the name implies, this is a web-based administration tool. It runs on your computer, there’s no cloud involved, and has its own built-in web server. That means you don’t have to worry about installing something like Apache, or concern yourself with how it may interact with any existing web server you run. Once installed and running you can point your browser at https:// localhost:10000 and start exploring the many options available.…

Editing photos isn’t the same as editing general images. Therefore we decided to compare some of the best photo editors for Linux with a focus on fixing common faults, enhancing colours and lost details that might be considered gone for good. The aim here is to help you select the most feature-packed and practical software that can bring dull images back to life. We’ll take a closer look at their advanced features, such as automatic enhancements, the ability to fix dull, blurry, under-or over-exposed images and, of course, whether or not they handle RAW files. It’s not the first time we’ve run a Roundup on image or photo editors, but this current group includes a different selection of software. Four out of the five are open source tools (although Lightzone…

We may prefer one tool over another purely for subjective reasons, but there are some practical tests that expose the real value of each photo-editing program. For this Roundup we used a couple of images as test subjects when exploring the five programs. One was a scanned historic colour film frame with inadequate lighting, film grain and insufficient exposure, while another was an unprocessed RAW shot of a night urban scenery with illumination, which was also underexposed. The aim was to try to achieve the best possible results from both shots in each of our five programs. We paid special attention to the white balance fixer and any available colour adjustment sliders, as well as the shadows, highlights and level correction tools. In the end, a good program is one…

Some people will argue that we forgot about AfterShot Pro from Corel, as well as some heavy-weight open source packages like Digikam or Krita. Well, AfterShot Pro is proprietary software with a price tag to boot, and we certainly don’t want to turn our group test into an OSS vs proprietary software war. Digikam is very good indeed and delightful to work with, but it focuses on collecting and sorting photos rather than on editing and processing. Finally, Krita is a great tool for digital artists, comics writers and artwork designers, but it’s far less robust when used for editing photographs. Other alternatives also exist, and you may have read about them in previous issues of Linux Format (for example, Photivo (see LXF238) and Fotoxx, to name just two). We,…

Databases are regularly hacked and a tasty selection of the hashed passwords within deciphered. These credentials (and easy-to-generate variations of them) are then tried on other sites. Using a password manager is a good way around this, but best practice dictates that you should first scour the deepest recesses of your brain and try and remember everywhere you have a login, then generate new secure passwords for these sites before storing them. There are a few options here. For $1.55/month Lastpass will take care of your passwords via a browser extension. Alternatively, the open source KeePassXC is in the Ubuntu repositories, so can be gotten straight from the Mint Software Manager. Many sites enforce two-factor authentication (2FA) nowadays, which usually involves a code being sent by SMS. This process can…

Steganography achieves secrecy by hiding a message so no one would suspect it was present, such as a text document or Jpeg image. It’s not hard to devise a method of embedding a message in a text file – for example arranging the text so that the hidden message is revealed by extracting every 10th letter – but this would usually result in contrived looking text which would look suspicious. More common, because it’s much less obvious to a casual observer, is to embed the message in an image. For example, the message could be encoded into the least significant bit of the values that define the colour of adjacent pixels. Given that pixels often have at least 24-bit values, a change of just one in 16.7 million possible colours…

A thorn in the side of Scratch was the reliance on the ancient and security-holed Flash. So the move to Scratch 3 and a HTML5 engine was always going to be cause for celebration. So celebrate, as here comes Scratch 3! Big changes to Scratch 3 other than the underlying engine, is a new paint and audio editing tool, which makes a lot of sense considering how media orientated Scratch projects tend to be, plus new code blocks, which have also had a design tweak to make them easier to read. This is obviously a big change and Code Club and the Pi Foundation are all over it, updating existing projects to support the latest version of Scratch. However, one snag is there’s no offline mode for Scratch 3 as…

For this tutorial we shall take our first steps in creating a demo. These were popular in the ‘80s and ‘90s on the Amiga and Atari computers. They showcased the power of the computer and the prowess of the coder. Typically, these demos (http://ada.untergrund.net) were used by rival “crack teams” who broke copy protection on games. But they grew into an art form that led to many bedroom coders becoming big names in the computing industry. We shall be using Pygame Zero to create our own demo using a little Python code and some assets created in image editors and music applications. More on that later. To write the code for this project we need to install Mu, a simple Python IDE for beginners. We install Mu because it’s a…

The active tags used in this article are not the only form of RFID tag. There are active versions that contain a small battery, which provides additional power to the transmitter. This directly leads to a greater range, because the card can contain a readback amplifier and doesn’t need to be powered from the reader. Many, if not most high-range systems use active tags. Sadly, using active tags causes maintenance hassles. Prepare to see many “empty batteries” if untrained or unmotivated workers are involved. A client of the author experimented with active tags in school kid transportation – the project was, as expected, a catastrophic failure because parents forgot to exchange the batteries regularly. Hey ho… Furthermore, active tags tend to be more expensive than their passive colleagues. This investment…

To configure Betty to fetch information from the internet, you must run betty turn web mode on . Unfortunately, many Linux distributions report errors with the SSL certificate on the default search engine used by Betty. You must edit main.rb before you can perform an internet lookup with Betty. This involves editing two lines in the file. You can run the following command to install a patch, which will automatically make the relevant changes to the main.rb file: You can now run commands to find the weather in any location, look up news, or people, or even perform translations: The one major downside to the internet queries is that Betty doesn’t format text for easy assimilation. To enable speech, you must run the betty talk to me command. Betty will…

If you choose all your settings yourself, things may quickly get complex, and it might become tricky to find a particular setting. The solution is to use a file for each feature or sub-system. This means you can find the file on code completion in one file, Python-specific settings in another and so on. The other solution is to have one org file with a heading for each of your needs. Emacs can’t read an org file to start and use the configuration you have. However, you can create an init.el that tangles your org file and uses it to initiate everything. The code to do this is simple: it uses babel which distinguishes the code source blocks from everything else, creates an .el file from it and then executes…

Domain Names System or DNS, in short, is the Internet’s address book. It’s also a major part of the URL string you type into an address bar. Many say URLs are irrelevant today, because you can type search terms directly as well. However, you (or your browser) would still need how to request a search engine. IP addresses aren’t good for that: they are hard to remember and change over time. DNS is a venerable protocol (both RFC 1034 and 1035 date back to November 1987) and as such enjoys many implementations. For generations of us, admins BIND was a de-facto synonym to DNS. It’s still relevant today and widely used, but it’s not the only one out there. In this Administeria we’ll take a sneak peek on two others……

VIRTUALISATION SOFTWARE Virtualbox Version: 6.0 Web: www.virtualbox.org We can’t even begin to imagine how we’d cope with all the numerous tests and reviews we do without proper virtualisation middleware. This is also probably true for the many Linux enthusiasts who frequently take our hot software picks for a spin. There are a lot of ways to virtualise operating systems and tools, from the KVM-based Boxes that’s bundled with the Gnome desktop, to Docker containers that are ideal for testing new software. This review, however, is dedicated to Virtualbox – the most complete, feature-rich and fast open source solution that’s supported by Oracle. With this tool you can run almost any x86-compatible guest OS once you have a bootable ISO for it. As long as such a guest makes use of…

Stashing takes all the changes you made since the last commit and puts them in a local ‘stash’. This is great for trying out an idea or playing around with new features and avoids the feeling that you have to keep everything neatly in branches. To use it: Now you’re back to your previous commit but your recent changes have been ‘stashed’. To get them back, just: /path/to/my/project (master) $ git stash apply stash@{1} Or create a branch from the stash with: /path/to/my/project (master) $ git stash branch stash@{1} You can have multiple stashes in your local repository, which can be great for trying many things out. However, we strongly urge you to treat these as things that will disappear very soon. Good practice is to treat your local repository…

Cobra is a popular Go package that enables you to develop command line utilities with commands. If you’ve ever used hugo, docker or kubectl then you’ll understand immediately what Cobra does! As you’ll see in the rest of the tutorial, commands in Cobra can have one or more aliases, which is useful when you want to please both amateur and experienced users. Cobra also supports Persistent Flags as well as Local Flags. These are flags that are available to all commands and flags that are available to a given command only, respectively. Also, by default Cobra uses Viper for configuration. All Cobra projects follow the same development pattern. You use the cobra tool, then you create commands and then you make the desired changes in the generated Go source code…

Put a lock on your door and they get in through a window. Lock the window and they’ll just smash it. Put bars on the windows and they pick your door lock. Deadbolt the door and they will trick their way in pretending to be the gas man. An analogy, how quaint! Computer security can, at times, feel like an arms race between global superpowers. Yet at least with the Linux kernel and open source everything’s out in the open. Indeed, there’s an entire world of developers whose livelihoods depend on the FOSS ecosystem being secured. While we can’t guarantee absolute security, we can at least take the sensible steps down the path of reasonable security. Keep in mind that the majority of security breaches occur through human error. All…

Want to feel old? Of course you do! We’re now closer to the year 2038 than we are to the year 2000. This is important, because in January 2038 the 32-bit time_t value that’s used in Unix-like systems, will run out of bits and won’t be able to represent the correct time. The Millennium Bug crises was averted thanks to the hard work of developers and engineers around the world, and hopes are high that a similar effort will be successful for 2038’s problem. The good news is that work is well underway. In a blog post titled “Approaching the kernel year-2038 end game”, which can be read at http://bit.ly/lxf247-kernal-2038, Jonathan Corbet, founder of LWN.net, observes that while “the fact that systems being deployed now will still be operating in…

Last year, Chrome OS, Google’s operating system for Chromebooks and Chromeboxes, received a major new feature: the ability to run Linux software. At a stroke this transformed the operating system from a lightweight – yet useful – operating system into a genuinely powerful productivity tool. Previously, Linux programs were run in Chrome OS using a virtual Linux, based on Debian. This is all very well if you – or your company – run Debian-based distros, but for people who like to use other distros, Chrome OS’ Linux program support wasn’t quite as useful. That’s set to change, according to a report on 9to5Google (http://bit.ly/lxf247-chromeos-linux), which suggests that Google will soon employ device policy settings. These will enable people and companies to choose which Linux distro is used. Administrators will be…

ZEVENET 5.9 The latest version of the load balancer and application delivery system, which is based on Debian, has been released. The latest release brings a number of package upgrade, but perhaps most importantly it moves from i686 to 64-bit architecture. There’s an upgrade to the 4.19 kernel, and IPv6 support is now included as well. Check out the release announcement at www.zevenet.com/blog/new-zevenet-community-5-9-released. PROJECT TRIDENT 18.12 This operating system for desktop PCs is based off TrueOS, which is regularly updated and values its users’ privacy. Its first official stable release is now available to download. It’s based on the 18.12-stable branch of TrueOS, and comes with improvements to the Chromium and Iridium browsers. There’s also a number of new and updated packages, and you can see the whole list at…

Linus Torvalds announced Linux 5.0-rc1, noting that it “was a fairly unusual merge window [period of time during which disruptive changes are added in a release cycle] with the holidays, and as a result I’m not even going to complain about the pull requests [code contributions] that ended up coming in late.” There was no specific technical reason for bumping the revision to 5.0 now, as opposed to going with 4.21. Instead of a compelling new feature, Linus simply remarked that, “I ran out of fingers and toes to count on, so 4.21 became 5.0.” This is similar to how 4.0 happened, although without the convenience of hitting a suitable milestone number of git commits. IT’S POSSIBLE FOR AN ATTACKER TO DETERMINE WHETHER SPECIFIC FILE DATA IS PRESENT OR NOT……

Build Brighton Thursday evenings is open night. www.buildbrighton.com Cornwall Tech Jam Second Saturday of the month alternating between Bodmin and Camborne. www.cornwalltechjam.uk Huddersfield Raspberry Jam Meet every month at Huddersfield Library, typically on the fourth Saturday of each month. https://huddersfieldraspberryjam.co.uk Horsham Raspberry Jam Park side, Chart Way, Horsham. www.facebook.com/hackhorsham Leeds Hackspace Open night every Tuesday 7pm-late, Open day second Saturday of the month, 11am-4pm. www.leedshackspace.org.uk Medway Makers 12 Dunlin Drive, St Mary’s Island, Chatham ME2 3JE. www.medwaymakers.com rLab Reading Hackspace Unit C1, Weldale ST, Reading, Open Sessions Wednesday from 7pm. http://rlab.org.uk Glasgow Makers and Hardware Hackers Mitchell Library, Glasgow. https://m.facebook.com/groups/115303729096198 Teesside Hackspace Tuesday Evenings at Teesside Hackspace. www.teessidehackspace.org.uk…

Buggy archive First, many thanks and kudos for adding a new LU&D section as part of the Linux Format archive. It’s greatly appreciated! There does, however, appear to be an error in the PDF for issue 182 of Linux User & Developer. The image appearing for page 60 is a repeat of page 54 instead of the actual page 60. I don’t know if that’s related to the “work in progress” note on the link on the Linux Format archive page, but I thought that I would bring it to your attention. Thanks again for the archive. R Shaw, via email Neil replies Glad you’re enjoying the archive addition – we do hope it’s a decent bonus for subscribers! And thanks very much for pointing out the odd mistake. I…

Q Could you tell me how to get my Canon TS8051 multi-printer running under Linux Mint 19 which I’ve downloaded off your latest DVD. I’ve tried various downloads from Canon and looked on the forums for advice, but I would be very pleased if you could publish the instructions, because when I try to run them in the terminal it just says they’re not there or cannot find them, although when I look in Downloads they are. I’d like to know if there’s an easy way to extract and install them as I’m not too sure of the old way to use tar.gz, etc. John Jackson, via email A Installing printer drivers on Linux is often harder than it needs to be. The notable exception being most HP devices that…

The reason why we equipped Gimp with third-party plug-ins is because they grant the program advanced tools for combating colour noise and removing grain. The Repair category inside the G’MIC interface contains some advanced denoising filters, of which the most powerful is perhaps Iain’s Noise Reduction. This filter contains a range of configurable options that effectively remove film grain or colour noise that has been created by high ISO values. We managed to achieve reasonable results simply by combining several filters in succession. However, the built-in options for reducing noise and grain in Darktable proved to be even more efficient because they managed to preserve details more effectively. Darktable has a bilateral denoise feature for high ISO; the non-local tool can be used when denoising chroma and luma; there’s a…

Using Cloudflare’s DNS will reduce the potential for your browsing habits to be sold to the highest bidder, but it’s foolish to ignore the fact that those requests are still unencrypted. If you’re really concerned (and have figured out that DNSSEC is too complicated for most humanoids) then you can set up DNS over HTTPS (DoH), or something similar like DNS over TLS or DNSCrypt. These wraps an encryption layer around DNS requests, keeping them from prying eyes (although prying eyes can still see SNI requests). One option is to use DNSCrypt-proxy, which runs a DNS ‘stub resolver’ locally, on port 53. You’d change resolv.conf to use this as a nameserver and it would send encrypted queries to servers. There are a few snags, such as without explicitly setting it…

Thea Aldrich is a developer advocate for the Zephyr Project, a Linux Foundation project that aims to create an open source, real-time operating system for the Internet of Things (IoT). Before that she’s been involved with gathering and contributing geospatial data for the OpenStreetMap project as well as working for the Eclipse Foundation. She’s also responsible for the first Ruminant Area Network we’re aware of – a quartet of cattle equipped with sensors – but we’re told that project has since been put out to pasture. We caught up with her at the Linux Foundation’s Open Source Summit in the culture (and saturated fat)-rich city of Edinburgh to talk security, community and caring for your hair in wintery conditions. Linux Format: Let’s talk about real-time operating systems (RTOSes) first. What…

Before the Raspberry Pi was released there was a Linux distribution that was being used to show off the power of the Pi. In fact, the first few media outlets to gain access to the development kits, including the BBC, saw Fedora as the default Pi distro. But when the Pi was first released there was a change in distro. Enter Raspbian… Based upon Debian, Raspbian is used on many different types of machines, from low-power devices such as the Pi to huge data centres. But when Raspbian first came to the Pi it was rather rough around the edges. It took lots of work from the Raspberry Pi Foundation and a collective effort from the Raspberry Pi community to refine it. Thanks to Mike Thompson and Peter Green we…

Our demo uses two images and one audio file. But where can we get them from? Well, if we need images we can use the artwork at openclipart.org because all of the images there are royalty free and in the public domain. For audio, take a trip to YouTube, which has a selection of copyright-free music tracks and sound effects. Go to www.youtube.com/audiolibrary/music to see the vast selection on offer. You can also visit https://cchits.net, which is a curated list of the top 15 Creative Commons music tracks. But if you want to create your own assets then consider using Inkscape or Gimp to create images. Inkscape is a vector image editor and is excellent for accurate drawings. Gimp is similar to Photoshop and can be used to enhance an…

Long data lines act as “magnets” for all kinds of unwanted effects. A few zener diodes or similar protective elements are a good investment as the range increases. Housing antenna coils can be difficult. Prefabricated housings such as the ones by Hammond provide a nice way around the problem – simply tack the coil with a bit of hot glue. A small hole in the housing’s frame makes passing the antenna cable in and out an easy task. Housings for antennas must not consist of ferrous materials. Using a steel or a cast iron case is a sure-fire way to greatly reduce your RFID systems range.…

RFID tags exist in three different frequency bands. Our example uses 125KHz cards, which are the oldest and most common format. The long wavelength makes them extremely resilient – they can also be attached to humid bodies – think (human?–Ed) cattle. Sadly, the reading range is extremely limited: achieving more than a meter or so is difficult even with very large antennas. 13.56MHz cards are commonly known as NFC or HF tags. Their reading range is a bit higher, but the lower wavelength makes them less robust against interruptions. Furthermore, 13.56MHz cards are extremely common – bank cards, fitness membership tags and other items usually work in this frequency range. This is problematic because it leads to a higher probability of “foreign” objects showing up in your reader’s range. Finally,…

Do you struggle to stay on top of your finances? Can’t ever seem to work out exactly where your money goes or how much is in your bank accounts? What you need is HomeBank, a free tool that enables you to record, track and analyse your financial ins and outs, giving you everything you need to get on top of your money and stay in control of it. Although HomeBank can be installed direct from the Ubuntu Software Centre, you won’t find the latest version there. To ensure you’re running the latest build, open a Terminal window (press Ctrl + Alt + T) and then type the following commands: Once installed, HomeBank will appear in the Show Applications list. Click to launch it. A welcome dialog will appear, providing a…

HomeBank records your finances through several layers of data. At the top is your main file, or ‘wallet’ as HomeBank describes it. Beneath this is the account level, where you can store multiple accounts – current, savings, credit card, and even loans and mortgages. The final, bottom layer is transactions, which are attached to specific accounts. Each transaction is assigned a specific type of payment, from credit or debit card, electronic payment and direct debit or standing order to deposit, cash, financial fee (for example, a non-sterling payment charge when paying for goods in a foreign currency) and transfer between accounts. Choose Internal transfer if you wish to transfer money from one account in HomeBank (say savings) to another (your current account, or perhaps your credit card when paying the…

Sometimes GDevelop can get obtuse, but Piskel is relatively straightforward. The main central area is where you draw, the chequered grey background signifying transparency. If you want to create a series of images based on an initial template, draw your first image and then add the number of frames you want to fill. In the Transform box you can now click the Clone icon. To see your work, towards the top-right corner is a preview window showing all of the animation frames playing in sequence. If you look just below the previewer, there is a slider showing the number of FPS (Frames Per Second). When you’re done, click Save to GDevelop over in the far top-right hand corner.…

To help keep your code readable, follow PEP8 - The Python coding style guide. Keep the style guide in mind when you’re writing Python code – the guide is available here: https://pep8.org . You can change all settings using the Customize feature. This can be useful if you’re struggling with the format of Elisp. The names of all the parameters. Settings are placed in your init.el file. When you want to try out a new feature, start Emacs with the -q parameter. You’ll then start an instance without any packages configured. Then use the scratch buffer to try out the features and copy the result into your initiating file.…

DNS is perhaps the most well-known example of a protocol that runs over UDP, but it doesn’t have to be. DNS messages larger than 512 bytes and zone transfers occur over TCP for reliability reasons. In today’s world, there are modern transports for DNS as well. The first one is DNS over HTTPS (DoH) which you have probably heard of, especially if you were following Mozilla’s newsletters. Firefox has supported it since version 62, and so do a couple of public DNS servers. DoH sends DNS queries plain over HTTPS (typically, HTTP/2) connection as GET or POST with a custom content type, application/ dns-message. This way, you get encryption for free, and since your DNS queries now look indistinguishable from HTTP traffic, non-amicable third parties would have a hard time…

This Google Tech Talk from Linus Torvalds from 2007 ( http://bit.ly/linus-git-talk  ) is worth watching for the historical context and how it emerged out of his frustration with other tools. If you’ve made changes that you don’t want to commit, you can revert them to the latest commit using ‘git checkout [path to file]’. This lets you get comfy trying things out, knowing that you can always undo any changes, as git is keeping track. Git creates a file called ~/.gitconfig to house your configuration. In here you can create aliases to save you time like git co for checkout, git di for diff and so on. Find out more at https://githowto.com/ aliases .…

Viper and Cobra are two Go packages that enable you to create powerful command line tools such as docker and kubectl. Among other things, in this tutorial you’ll learn how to tell Viper to read JSON and YAML configuration files and how to create command line utilities with commands and subcommands using Cobra. You’ll need to download both Go packages before using them for the first time because they’re not (yet) part of the Standard Go Library, which is the subject of the first section. Snakes on a terminal You can download Viper as well as another handy Go package related to Viper named pflag by executing the following commands: Similarly, before using Cobra for the first time you should execute the following commands in order to obtain all the…

We’ve been eagerly awaiting Purism’s Librem 5 open source smartphone, and a recent update from the team suggests that the device is steadily getting closer to release. In case you’ve missed us harping on about the Librem 5 (https://puri.sm/products/librem-5 ) , this is a smartphone that uses the PureOS (https://pureos.net) operating system with a focus on privacy and utilising ethical, open-source software and technology. In a recent blog post (see http://bit.ly/lxf247-librem-blog), Eric Kuzmenko of Purism outlined how the project ensured that the Librem 5 uses completely free software. Eric explains how the development of the Librem 5’s dev kit took shape, with the team deciding which electronic design automation tool they would use. According to the blog “the idea was to modify FEDEVEL’s i.MX 6QP OpenRex board, which would have…

“Panfrost, the latest effort to deliver a free and open source implementation of a driver for the newest versions of the Arm Mali family of GPUs, is gaining traction. It can now run applications on Wayland and directly on top of kernel mode-setting, including Wayland compositors such as Weston, and other applications such as media center Kodi. The efficient implementation supports zero-copy display of GPUrendered Wayland clients, as well as media content from external hardware blocks. This work removes one more barrier to widespread adoption of Panfrost, while making it easier for developers to work on the rendering aspect. While the winsys and rendering support are based on Arm’s out-of-tree kernel driver, the community is working on a Mali DRM driver for mainline kernel inclusion. Panfrost could finally be an…

There’s good news for people who have been frustrated by poor video playback using the Chrome web browser in Linux, because the upcoming Chrome 73 update will be enabling Mojo Video Decoders by default in Linux. Chrome for Windows gets this as default in Chrome 72. This is Chrome’s inter-process communication (IPC) mechanism, and with a new VDA layer (VDAv2), Mojo Video Decoder can use a computer’s GPU to decode video. The move to hardware decoding should hopefully make video playback through Chrome on Linux much better, and it addresses several bugs that are detailed in the tracker found at http://bit.ly/lxf247-chromium-bugs. Hardware video decoding in Linux via Chrome isn’t official yet, and as some critics have pointed out, this could just make Chrome a more resource-intensive program (and it’s enough…

“The Linux Foundation events are where the creators, maintainers and practitioners of the world’s most important open source projects meet. This year’s events will gather more than 35,000 open source influencers to learn from each other about new trends in open source and share knowledge of best practices across a range of projects and technologies. Events are hosted by The Linux Foundation and its projects, including Automotive Grade Linux, Cloud Foundry, the Cloud Native Computing Foundation and Kubernetes, Hyperledger, and LF Networking. The events also looking at the business side of open source, gathering managers and technical leaders to learn about compliance, governance, building an open source office and other areas. Linux Format readers may be especially interested in some of the big European open source events, which include KubeCon…

Patches for heterogeneous memory are under development and may be close to merging. These will bring support for new devices that look and behave as “memory” while not being traditional RAM. It includes workload accelerators for graphics or machine learning. Intel has published patches implementing support for usermode mwait (umwait), a performance optimisation present in future CPUs that will enable them to enter a lower power state when waiting for a task to finish. Granting user applications access to traditionally privileged instructions requires some careful juggling, which is what the patches take care of. The future of the “dosfstools” project is under debate. It contains some of the filesystem formatting tools needed for FAT filesystems under Linux, while the util-linux package contains those for other filesystems. It’s possible that the…

SCRATCH CONFERENCE EUROPE Scratch is a popular language that uses blocks to represent the structure of code. With it, children can easily build games and projects. For the first time, the European Scratch conference will be in the UK and this year it’s being hosted by the Raspberry Pi Foundation in Cambridge at Churchill College between 23 and 25 August. Tickets go on sale this April. More details via its blog post: www.raspberrypi.org/blog/announcingscratch-conference-europe-2019. SHEFFIELD RUBY USER GROUP Ruby is a fantastic programming language. It’s easy to read, understand and write, and it powers everything from Sonic Pi to web development via Ruby on Rails. But if you’re new to the language where can you get help? Well, a Ruby user group such as Sheffield’s offers the knowledge and environment to…

Send your thoughts to the Linux Format dungeon server at linuxformat@futurenet.com be picked as Letter Of The Month and win* an amazing 32GB Nitrokey Storage 2! The Nitrokey is worth a cool €149, has 32GB of hardware-encrypted storage, supports hidden volumes, secures your online accounts with onetime passwords, can encrypt emails, files and hard drives and is an open source, open hardware solution. Protected with AES-256 and RSA keys up to 4,096! Learn more at www.nitrokey.com.…

We’d love to try and answer any questions you send to lxf.answers@futurenet.com, no matter what the level. We’ve all been stuck before, so don’t be shy. However, we’re only human (although many suspect Jonni is a robot), so it’s important that you include as much information as you can. If something works on one distro but not another, then tell us. If you get an error message, please tell us the exact message and precisely what you did to invoke it. If you have, or suspect, a hardware problem, let us know about the hardware. Consider installing hardinfo or lshw. These programs list the hardware on your machine, so send us their output. If you’re unwilling, or unable, to install these, run the following commands in a root terminal and…

When it comes to selecting a photo editor, there’s plenty of choice. There are general-purpose editors like Gimp or Pinta, image library managers with editing features, such as Digikam or Shotwell, and finally there’s software for digital artists (think Krita). Our interest lies in fixing photos and processing RAW files, so we grabbed Gimp with its set of built-in effects, UFraw plugin, and lots of third-party plugins from FX Foundry and G’MIC. Then we included Darktable and Rawtherapee – two classic darkroom editors with tools for dragging out barely visible details. Lightzone is similar to these two programs, but has a more consumer-friendly interface. Last but not least is Pixeluvo, a paid-for program with a limited set of editing features. Gimp is the only contender that doesn’t use a dark…

Gimp shines in this test, because the program was created exactly for image manipulation of this kind. Gimp has the gorgeous Healing Brush tool for super-smart removal of any spot defects present within a photograph. Needless to say, Gimp’s selections, masks and layers that you can group or rearrange is something that any photo-retouching specialist frequently uses. Darktable has a useful spot removal tool, which also enables you to add circles, ellipses and custom outlines to your photographs. When used in conjunction with Masks, this makes it possible to repaint custom areas of the image, but it’s a far less intuitive process compared with using similar image-editing tools that live within Gimp. Speaking about Lightzone, there’s a roundabout way of working with layers within the program. Most filters in Lightzone…

Ubuntu includes Déja-Dup, which is a front-end for the command line tool Duplicity. This tool is pretty much the bees knees as far as backups are concerned. It can encrypt, back up to a remote location, and at the same time do incremental backups in order to conserve remote storage. Unlike Backup Tool it can also be easily automated. You’ll find Déja-Dup in Mint’s Software Manager, but for some reason it doesn’t install Duplicity as a dependency. It will prompt you to install it on first run though, or you can install it from the Software Manager before this. Once installed you’ll find a Backups shortcut in the Accessories menu. Once you’ve chosen which folders to back up and which to ignore, you must choose a back-up destination. Besides old…

Cryptography has its own language that you need to understand to get the most from this article. First, we need to differentiate between a code and a cipher because in everyday speech, the two words are used interchangeably. In a code, symbols of some sort are used to represent words or phrases. So, for example, if you ever watched Smokey and the Bandit, you’ll probably remember the immortal phrase “10-4 good buddy”, this being an example of the 10-code used on CB radio. The 10-code isn’t secret – it’s used to streamline communication – but codes can also be used for security purposes. Ciphers, on the other hand make changes not at the level of a word or phrase, but at the level of a single letter or byte. Ciphers…

Wiegand-based card readers must not be used in security-sensitive settings. Their word length of 26 bits can be brute-forced easily. This is especially important if your application has to handle large amounts of data and can’t implement a back-off delay – if the product at hand doesn’t require fast reading, then enforcing a five-second delay after two or three failed authentication attempts should be enough to thwart the average hacker. This, however, is just part of the problem. RFID readers are a dime a dozen, while RFID cards can be copied and emulated by microcontrollers. An attacker who has gained access to a card can “clone” it, and perform a replay attack to secure access to the goods at hand, even when the card isn’t present. This problem can be…

While most Bash ninjas wouldn’t bat an eyelid at the though of running complex commands, this author isn’t averse to making life easier for himself. If you’re fond of working on the terminal, but dislike having to remember the different commands and their sometimes complex syntax, Betty just might be the perfect tool for you. If nothing else, the use of natural language, as a substitute to manually invoking commands, will give you bragging rights. To install Betty, head over to the GitHub page and clone the repository with the command. The tool doesn’t require any installation. You must run the main.rb script to invoke Betty. If you'd like the ability to launch Betty from anywhere in the terminal then you must create an alias for the main.rb script: The…

If you want to split a single transaction between two or more categories – for example, you bought petrol and groceries at the same time – then click the Transaction splits button next to the Amount figure and use the wizard to assign the various amounts accordingly. You can create templates from existing transactions – select the transaction (or transactions) in the account and choose Transaction> Create Template. To edit these further, head to Manage> Scheduled/ Template… from the main window. Choose Transactions> Set Scheduler and you can configure HomeBank to quickly enter upcoming scheduled transactions. You can elect to enter all transactions up to a certain day of the month, or choose to input transactions for a set number of days in advance. Once done, choose Transactions> Post Scheduled…

One way to curb your spending is by setting monthly limits on what you spend on specific categories. By default, all accounts are included in budgets. If you want to exclude individual accounts for any reason, open Manage>Accounts from the main screen, select your account and tick ‘Exclude from the budget’ on the Options tab. Next, set your budget or budgets via Manage>Budget. Verify that Expense is selected, so only expense-related categories and subcategories are visible. Select the one you want to track. From here you can set a monthly budget or set budgets for different months of the year. When entering your budget, remember to add the minus (-) figure before it to indicate an expense and not income you’re tracking. At the bottom you’ll see a ‘Force monitoring…

It’s easy to get lost adding conditions because GDevelop has multiple names for the same thing. If you know the name of what you want, use the Search function in the top-left. Note that the order of your events is critical, because GDevelop will run events in sequence from top to bottom. If something doesn’t work right, it might just need moving. If you’re stuck trying to work out how to program something, remember your tutorial files. They’ve been cleverly designed to demonstrate specific algorithms for niche problems.…

With GDevelop being based on Javascript, you can also add your own custom Javascript coding. If you open the event editor, click ‘Choose and add an event’ (the biggest + sign towards the right) and then ‘Javascript code’. This will be treated like any other event and will be triggered each time the event is reached. Check the documentation for some examples, such as fading out a sprite when it hits the floor. Not only does GDevelop support mobile platforms (currently Android and partial support for iOS), but for the gaming capitalists out there, you can even put in your own ad-space with AdMob, and control where it’s placed. You are also able to enable the vibrate function on mobile phones and control how long it lasts. We won’t ask…

Prelude is a distribution that focuses on efficiency. The designers have prepared it for many programming languages, but by default doesn’t load them. The thinking is that you have it all ready to use, but you have to start it yourself. You choose which parts you want to load in your personal configuration file. This ensures that your running instance remains slim while still having plenty of features ready for when you start using another programming language. After you’ve changed your preferences, the easiest thing to do is to close Emacs and open it again. Emacs will load the new packages and so will be a little slower to start. While working on your projects, you can toggle the menu bar mode using F12. This is useful while you’re still…

How do you handle voting in your community? I don’t mean nationwide elections, but rather something local. Say, your community is about to elect a city mayor or decide if it’s okay to demolish an old building for a new mall. I never took the time to think of the possible options. One is to gather in a room and raise hands, another is to put votes on paper sheets and then put these sheets in a hat. None of these feel like 2019. And then how do you decide a winner? A simple majority is the usual answer, but it appears there are better approaches to take. Psychologists say grown-ups only learn from their personal experience. For me, there were two. The first experience was an election we ran…

When the cryptocurrency rush started a while ago, everyone began to mine. DNS admins were digging well before it became mainstream. Of course, I’m referring to a nifty little tool called dig. It’s a DNS client which you use to throw arbitrary DNS queries at any server. It also has some useful diagnostics built-in. Dig comes as a part of the dnsutils package and should be available in your distribution’s repositories, if not installed already. In the simplest case, you just do “dig something” to resolve a name. This uses whatever server you have in /etc/resolv.conf. A custom nameserver is specified as in dig @server something . By default, dig looks up an A record, but you can ask for something else: dig @1.1.1.1 gmail.com mx retrieves the list of…

The history that git collects can be used for many purposes: fixing bugs and finding where issues arose are the obvious ones, but you can also use it to find out each coder’s contribution: git shortlog -s -n There are a number of tools for exploring similar contribution statistics, but a particularly fun one is gource which visualises your git history. The grab from the Linux source video (page 88) shows the Linux kernel contributors (the little people) contributing to the source files (the leaves on the network). When they do a little laser-like ray goes from the contributor to the source. What’s particularly fun is when there’s a major contribution or refactoring, because a whole section of the source code will suddenly change and the tree will completely change.…

Both Go packages were initially programmed by Steve Francia ( https://spf13.com /) who currently works at Google. Steve is also the main developer of Hugo ( https://gohugo. io/), which is implemented using Cobra and Viper. The list of companies and command line tools that use Cobra and Viper includes Kubernetes, Hugo, rkt, etcd, Moby, Docker, OpenShift, Delve, GopherJS, CockroachDB, Bleve, Nanobox, rclone, nehm and many more! There are many good books that can help you learn Go including “Mastering Go” by yours truly and “The Go Programming language” by Alan Donovan and Brian Kernighan. The former is for amateur and intermediate programmers whereas the latter is more suitable for people who already know how to write code in another programming language.…

Viper is a Go package that supports many options. All Viper projects follow a pattern. First, initialise Viper, then define elements of interest. Then you get these elements and read their values to use them. The elements can be either taken directly, as it happens when you are using the flag package of the standard Go library, or using configuration files. When using formatted configuration files in JSON, YAML, TOML, HCL or Java properties format, Viper does all the parsing for you. Viper also enables you to extract and save values into Go structures. However, this also requires that the fields of the Go structure match the keys of the configuration file. The home page of Viper is at GitHub (https://github.com/spf13/viper). Studying the Go code of Viper or Cobra will…