Agreguesi i feed

Version:next-20190722 (linux-next) Released:2019-07-22

Version:5.3-rc1 (mainline) Released:2019-07-21 Source:linux-5.3-rc1.tar.gz Patch:full

Version:4.4.186 (longterm) Released:2019-07-21 Source:linux-4.4.186.tar.xz PGP Signature:linux-4.4.186.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-4.4.186

Version:4.9.186 (longterm) Released:2019-07-21 Source:linux-4.9.186.tar.xz PGP Signature:linux-4.9.186.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-4.9.186

Version:4.14.134 (longterm) Released:2019-07-21 Source:linux-4.14.134.tar.xz PGP Signature:linux-4.14.134.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-4.14.134

Version:4.19.60 (longterm) Released:2019-07-21 Source:linux-4.19.60.tar.xz PGP Signature:linux-4.19.60.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-4.19.60

Version:5.1.19 (stable) Released:2019-07-21 Source:linux-5.1.19.tar.xz PGP Signature:linux-5.1.19.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.1.19

Version:5.2.2 (stable) Released:2019-07-21 Source:linux-5.2.2.tar.xz PGP Signature:linux-5.2.2.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.2.2

desk lamp with mirror behind

Some time ago, I wanted to make my own desk lamp. It should provide soft, bright task lighting above my desk, no sharp shadows that could cover part of my work area, but also some atmospheric lighting around the desk in my basement office. The lamp should have a natural look around it, but since I made it myself, I also didn’t mind exposing some of its internals.

SMD5050 LED strips

I had oak floor boards that I got from a friend (thanks, Wendy!) lying around. which I used as base material for the lamp. I combined these with some RGBW led strips that I had lying around, and a wireless controller that would allow me to connect the lamp to my Philips Hue lighting system, that I use throughout the house to control the lights. I sanded the wood until it was completely smooth, and then gave it an oild finish to make it durable and give it a more pronounced texture.

Fixed to the ceiling Internals of the desk lamp

The center board is covered in 0.5mm aluminium sheets to dissipate heat from the LED strips (again, making them last longer) and provide some extra diffusion of the light. This material is easy to work with, and also very suitable to stick the led strips to. For the light itself, I used SMD5050 LED strips that can produce warm and cold white light, as well as RGB colors. I put 3 rows of strips next to each other to provide enough light. The strips wrap around at the top, so light is not just shining down on my desk, but also reflecting from walls and ceiling around it. The front and back are another piece of wood to avoid looking directly into the LEDs, which would be distractive, annoying when working and also quite ugly. I attached a front and back board as well to the lamp, making it into an H shape.

Light reflects nicely from surrounding surfaces

The controller (a Gledopto Z-Wave controller, that is compatible with Philips Hue) is attached to the center board as well, so I just needed to run 2 12V wires to the lamp. I was being a bit creative here, and thought “why not use the power cables also to have the lamp hanging from the ceiling?”. I used coated steel wire, which I stripped here and there to have power run through steel hooks screwed into the ceiling to supply the lamp with power while also being able to adjust its height. This ended up creating a rather clean look for the whole lamp and really brought the whole thing together.

This week we’ve been buying a new phone and playing with QEMU. We discuss the release fo Debian 10, Ubuntu users saying “Thank you”, Nvidia drivers, WSL and Ubuntu MATE for the GPD MicroPC. We also round up some events and tech news.

It’s Season 12 Episode 15 of the Ubuntu Podcast! Mark Johnson, Martin Wimpress and Stuart Langridge are connected and speaking to your brain.

In this week’s show:

• We discuss what we’ve been up to recently:
  • Mark has been buying a new phone.
  • Stuart has been playing with QEMU.
• We discuss the community news:
  • Debian 10 Buster is released
  • Will Cooke has a nice message
  • Introducing ubuntu-wsl, the package making Ubuntu better and better on WSL including a fresh Ubuntu wiki page about WSL
  • Ubuntu MATE 19.10 is coming to the GPD MicroPC
  • Ubuntu LTS Linux Distributions Will Now Get The Latest Nvidia Drivers Installed Automatically

• We mention some events:
  • UbuCon Europe 2019: 10th to 13th of October 2019 – Sintra, Portugal.
  • Oggcamp 19: 19th to 20th of October 2019 – The Manchester Conference Centre, Pendulum Hotel, Manchester UK.
• We discuss the news:
  • Internet group brands Mozilla “internet villain” for supporting DNS privacy feature
  • Maintainer for gpodder.net needed
  • Raspberry Pi 4 doesn’t work with some USB-C cables
• Image taken from Diablo published in 1996 for PC by Blizzard Entertainment.

That’s all for this week! You can listen to the Ubuntu Podcast back catalogue on YouTube. If there’s a topic you’d like us to discuss, or you have any feedback on previous shows, please send your comments and suggestions to show@ubuntupodcast.org or Tweet us or Toot us or Comment on our Facebook page or comment on our sub-Reddit.

• Join us in the Ubuntu Podcast Telegram group.

Lifecycle management entails fulfilling changing requirements over time. However, there is a gap that the existing robot development frameworks do not address, making it challenging to tackle system-level requirements (fault tolerance, system safety, maintainability, interoperability or reusability etc…). Ubuntu Core aims at closing this gap by complementing existing frameworks with a set of tools that enable the long term viability of robotic projects. Referring to system life cycle standard ISO/IEC 15288, we will describe how Ubuntu Core enables success in each specified stage.

ISO/IEC 15288: System Life Cycle Concept and Development phases: accelerating prototyping

Ubuntu makes it really easy to start a robotic POC by removing all the barriers that an innovator may encounter in getting a project off the ground. Developers can embed Ubuntu at no cost to their hardware of choice. Being open source, it is also easy to tailor Ubuntu to the specific needs of a project. Developers love Ubuntu. This popularity brings the benefits of broad community support and therefore a large pool of developers to contribute to, or help you troubleshoot your applications. What’s more, the popularity of Ubuntu drives off-the-shelf development board support, making it easy to find suitable hardware to start prototyping.

Development and production phases: bringing continuous delivery and integration to robotics

Delivering software upgrades to a fleet of robots operating in the field is a tedious task involving manual intervention and disrupted operations. As the consequence bug fixes are very costly to deploy. Additionally, the lack of agility in the delivery of security upgrades exposes to security vulnerabilities. To reduce this exposure, Ubuntu Core makes use of snaps. These are containerised software packages that are upgraded automatically. Snapcraft, the developer tool dedicated to the creation and delivery of snaps is easy to integrate into CI pipelines. On the operations side, Snapd is a tool that exposes an API to automate the deployment of snaps on robots in the field. Channels and tracks allow for the deployment of different versions of the software on the same fleet, or even on the same unit. Software be tested on dedicated units, before it is rolled out to an entire fleet.

Utilisation phase: unlocking new revenue models

Snaps open the door for robotics-as-a-platform. Robots embedded with Ubuntu Core will not be expensive single purpose assets anymore, but rather channels for services mediated by software-defined hardware. This is an important paradigm shift with the potential to unlock new business models and stimulate innovation in robotics. From application marketplaces to paid add-ons, or pay per use, new avenues to generate recurring revenue from a robot become possible.

Support phase: security and reliability through cloud integration

Ubuntu Core is designed as a security-first OS. The system is tamper-resistant and processes are strictly confined to their own environments. In addition to this inherent security, maintenance of system security is assured for as long as 10 years through Extended Security Maintenance (ESM). Snaps update automatically, which means that non-disruptive updates are provided continuously. This happens in a transactional manner that preserves data and rolls back on error, assuring system reliability.

Retirement phase: stretching the useful life of robots

The snap packages underlying Ubuntu Core enable function virtualisation. New functionalities can be packaged and delivered to a robot through self-contained snaps at any point of its service life. For instance, machine learning capabilities can be added to an existing cleaning robot, extending the scope of its functionalities. The ability to push new functions to a robot can be leveraged to delay their obsolescence. This will stretch the useful life of robot fleets, with a positive effect on the overall economics for both operators and makers of robots. This capability will have repercussions on the hardware architecture of robots. Makers will be incentivised to build more robots as futureproof platforms. Hardware and software upgrades will be delivered during the life of robots to make them evolve, pushing back the boundaries of obsolescence.

The post Robot lifecycle management with Ubuntu appeared first on Ubuntu Blog.

Kubuntu 18.10 Cosmic Cuttlefish was released on October 18th 2018 with 9 months support. As of 18th July 2019, 18.10 reaches ‘end of life’. No more package updates will be accepted to 18.10, and it will be archived to old-releases.ubuntu.com in the coming weeks.

The official end of life announcement for Ubuntu as a whole can be found here [1].

Kubuntu 19.04 Disco Dingo continues to be supported, receiving security and high-impact bugfix updates until January 2020.

Users of 18.10 can follow the Kubuntu 18.10 to 19.04 Upgrade [2] instructions.

Should for some reason your upgrade be delayed, and you find that the 18.10 repositories have been archived to old-releases.ubuntu.com, instructions to perform a EOL Upgrade can be found on the Ubuntu wiki [3].

Thank you for using Kubuntu 18.10 Cosmic Cuttlefish.

The Kubuntu team.

[1] – https://lists.ubuntu.com/archives/ubuntu-announce/2019-July/000247.html
[2] – https://help.ubuntu.com/community/DiscoUpgrades/Kubuntu
[3] – https://help.ubuntu.com/community/EOLUpgrades

At the end of last year I decided it was time to upgrade my home server. I built it back in 2013 as an all-in-one device to be my only always-on machine, with some attempt towards low power consumption. It was starting to creak a bit - the motherboard is limited to 16G RAM and the i3-3220T is somewhat ancient (though has served me well). So it was time to think about something more up to date. Additionally since then my needs have changed; my internet connection is VDSL2 (BT Fibre-to-the-Cabinet) so I have an BT HomeHub 5 running OpenWRT to drive that and provide core routing/firewalling. My wifi is provided by a pair of UniFi APs at opposite ends of the house. I also decided I could use something low power to run Kodi and access my ripped DVD collection, rather than having the main machine in the living room. That meant what I wanted was much closer to just a standard server rather than having any special needs.

The first thing to consider was a case. My ADSL terminates in what I call the “comms room” - it has the electricity meter / distribution board and gas boiler, as well as being where one of the UniFi’s lives and where the downstairs ethernet terminates. In short it’s the right room for a server to live in. I don’t want a full rack, however, and ideally wanted something that could sit alongside the meter cabinet without protruding from the wall any further. A tower case would have worked, but only if turned sideways, which would have made it a bit awkward to access. I tried in vain to find a wall mount case with side access that was shallow enough, but failed. However in the process I discovered a 4U vertical wall mount. This was about the same depth as the meter cabinet, so an ideal choice. I paired it with a basic 2U case from X-Case, giving me a couple of spare U should I decide I want another rack-mount machine or two.

My old machine has 2 3.5” hotswap drive bays; this has been useful in the past when a drive failed even just to avoid having to take the machine apart. I still wanted to aim for low power consumption, so 2 drives is enough. I started with a pair of cheap 5.25” drive bay to dual 2.5” + 3.5” hotswap bay devices, but the rear SATA connectors ended up being very fragile and breaking off, so I bit the bullet and bought a SilverStone FS303. This takes up 2 5.25” bays and provides 3 x 3.5” hotswap bays. It’s well constructed and the extra bay has already turned out useful when a drive started to fail and I was able to put the replacement in and resync the RAID set before having to remove the old drive.

Now I had the externals sorted I needed to think about what to put inside. The only thing coming from the old machine were the hard disks (a 4T Seagate and a 6T WD RED, 4T of software RAID1 and 2T of unRAIDed backup space), so everything else was up for discussion. I toyed with an Intel i7-8700T - 6 cores in 35W. AMD have a stronger offering these days though and the AMD Ryzen 2700E with 8 cores in 45W seemed like a good option for an extra 10W. Plus on top there are several of the recent speculative execution exploits that don’t seem to affect AMD chips (or more recent Intel CPUs, but they weren’t out at the time in a low power format). Sadly the 2700E proved to be made of unobtanium; I sat with it on backorder for nearly 3 months before giving up and ordering a AMD Ryzen 2700 that was on offer. This is rated at up to 65W, but I considered trying to underclock if necessary or tweak the cpufreq settings at least.

Next up was a motherboard. The 2U case is short, but allows for MicroATX, an improvement over the MiniITX my last case needs. One of the things constraining me with the old machine was that it maxed out at 16G RAM, so I wanted something that would take more. It turns out there are a number of Socket AM4 MicroATX boards that will take 64G over 4 DIMMs. I chose an ASRock B450M Pro4, which had a couple of good reviews and seemed to have all the bits I wanted. It’s been decent so far - including having some interactions with ASRock support when I initially put an AMD 240GE (while waiting for the 2700E that was never coming) in it. I like to think of BIOS 3.10 as mine ;).

For RAM I went with a Corsair CMK32GX4M2A2400C14 Vengeance LPX 32GB (2 x 16GB) set. I’m sure I should care more about RAM but it was decently priced from a vendor I trust. At some point I’ll buy another set to bring the board up to the full 64GB, but for now this is twice what the old machine had.

Finally I decided to splash out on some SSD. The spinning rust is primarily for media (music + video shared out to Kodi etc) and backups, but I wanted to move my containers (home automation, UniFi controller, various others) over to SSD. I talked myself into a pair of Corsair MP510 960GB NVMe M.2 drives. One went on the motherboard slot and I had to buy a low profile PCIe adaptor for the other (of course they’re RAID1ed). They fly; initially I clocked them in at about 1.5GB/s until I realised the one in the add-in card was only using 2 PCIe lanes. Once I rejigged things so it had all 4 it can use I was up to 2.3GB/s. Impressive.

You’ll note I haven’t mentioned a graphic card here. I ended up with a cheap NVidia off eBay to get things going, but this is a server in a comms room and removing the graphics card saves me at least 10W of power (it was also the reason the NVMe drive only had 2 lanes). I couldn’t find an AM4 motherboard that did serial console, but the 450M Pro is happy to boot without a graphics card present, and I have GRUB onward configured to do serial console just in case.

And the power consumption? The previous machine idled at around 50W, getting to maybe 60-65W under load. I’ve cheated with the new machine; because the spinning rust is not generally in use it’s configured to spin down after 20 minutes idle. As a result the machine idles at around 36W. It hits 50W when the drives spin up, so for 8 cores compared to 2 we’re still sitting in the same ballpark. That’s good, because that’s the general case - idle here means Home Assistant operational, the UniFi controller going, the syslog container logging and so on. However the new server peaks considerably higher; if the drives are spun up and I compile a kernel I can hit 120W. However the compilation takes less than a quarter of the time - the machine is significantly faster than the old one, and even without taking advantage of the SSDs idles at roughly the same power level. I’d call that an overall win.

In recent times, there has been increasing attention on all forms of abuse and violence against women.

Many types of abuse are hidden from public scrutiny. Yet there is one that is easily visible: the acid attack.

Reshma Qureshi, pictured above, was attacked by an estranged brother-in-law. He had aimed to attack her sister, his ex-wife. This reveals one of the key attributes of these attacks: they are often perpetrated by somebody who the victim trusted.

When so many other forms of abuse are hidden, why is the acid attack so visible? This is another common theme: the perpetrator is often motivated to leave lasting damage, to limit the future opportunities available to the victim. It is not about hurting the victim, it is about making sure they will be rejected by others.

It is disturbing then that we find similar characteristics in online communities. Debian and Wikimedia (beware: scandal) have both recently decided to experiment with publicly shaming, humiliating and denouncing people. In the world of technology, trust is critical. People in positions of leadership have found that a simple email to the press can be used to undermine trust in a rival, leaving a smear that will linger, like the scars intended by Qureshi's estranged brother-in-law. Here is an example:

Jackson's virtual acid attack was picked up by at least one journalist and used to create a news story.

Some people spend endless hours talking (or writing) about safety and codes of conduct, yet they seem to completely miss the point. Personally, I don't object to codes of conduct, but we have to remember that not all codes of conduct are equal. In practice, the use of codes of conduct in many free software communities today looks like this:

If you search for sample codes of conduct online, you may well find some organizations use alternative titles, such as a statement of member's rights and obligations. This reminds us that you need to have both.

When we see organizations like FSFE and Debian trying to make up excuses to explain why members can't be members of their respective legal bodies, what they are really saying is that they want the members to have less rights.

When you have obligations without rights, you end up with slavery and cult-like phenomena.

History lessons

One of the first codes of conduct may be the Magna Carta from the year 1215. Lord Denning described it as the greatest constitutional document of all times – the foundation of the freedom of the individual against the arbitrary authority of the despot.

In other words, 800 years ago in medieval England they came to the conclusion that members of a community couldn't be punished arbitrarily.

What is significant about this document is that the king himself chose to be subjected to this early code of conduct.

An example of rights

In 2016, when serious accusations of sexual misconduct were made against a volunteer who participates in multiple online communities, the Debian Account Managers sent him a threat of expulsion and gave him two days to respond.

Yet in 2018, when Chris Lamb decided to indulge in removing members from the Debian keyring, he simply did it spontaneously, using the Debian Account Managers as puppets to do his bidding. Members targetted by these politically-motivated assassinations weren't given the same two day notice period as the person facing allegations of sexual assault.

Two days hardly seems like sufficient time to respond to such allegations, especially for the member who was ambushed the week before Christmas. What if such a message was sent when he was already on vacation and didn't even receive the message until January? Nonetheless, however crude, a two day response period is a process. Chris Lamb threw that process out the window. There is something incredibly arrogant about that, a leader who doesn't need to listen to people before making such a serious decision, it is as if he thinks being Debian Project Leader is equivalent to being God.

The Universal Declaration of Human Rights, Article 10 tells us that Everyone is entitled in full equality to a fair and public hearing by an independent and impartial tribunal, in the determination of his rights and obligations. They were probably thinking about more than a two day response period when they wrote that.

Any organization seeking to have a credible code of conduct seeks to have a clause equivalent to article 10. Yet the recent scandals in Debian and Wikimedia demonstrate what happens in the absence of such clauses. As Lord Denning put it, without any process or hearing, members are faced with the arbitrary authority of the despot.

The trauma of incarceration

In her FOSDEM 2019 talk about Enforcement, Molly de Blanc has chosen pictures of a cat behind bars and a cat being squashed in a sofa.

It is abhorrent that de Blanc chose to use this imagery just three days after another member of the Debian community passed away. Locking up people (or animals) is highly abusive and not something to joke about. For example, we wouldn't joke with a photo of an animal being raped, so why is it OK to display an image of a cat behind bars?

Deaths in custody are a phenomena that is both disturbing and far too common. Debian's founder had taken his life immediately after a period of incarceration.

Virtual incarceration

The system of secretly shaming people, censoring people, demoting people and running huge lynching threads on the debian-private mailing list has many psychological similarities to incarceration.

Here is a snapshot of what happens on debian-private:

It resembles the medieval practice of locking people in the pillory or stocks and inviting the rest of the community to throw rocks and garbage at them.

How would we feel if somebody either responded to this virtual lynching with physical means, or if they took their own life or the lives of other people? In my earlier blog about secret punishments, I referred to the research published in Social Psychology of Education which found that psychological impacts of online bullying, which includes shaming, are just as harmful as the psychological impact from child abuse.

Would you want to holiday in a village that re-introduced this type of cruel punishment? It turns out, studies have also shown that witnesses to the bullying, which could include any subscribers to the debian-private mailing list, may be suffering as much or more harm than the victims.

If Debian's new leader took bullying seriously, he would roll back all decisions made through such vile processes, delete all evidence of the bullying from public mailing list archives and give a public statement to confirm that the organization failed. Instead, we see people continuing to try and justify a kangaroo court, using grievance procedures sketched on the back of a napkin.

What is leadership for?

It is generally accepted that leaders of modern organizations should act to prevent lynchings and mobbings in their organizations. Yet in recent cases in both Debian and Wikimedia, it appears that the leaders have been the instigators, using the lynching to turn opinion against their victims before there is any time to analyse evidence or give people a fair hearing.

What's more, many people have formed the impression that Molly de Blanc's talks on this subject are not only encouraging these practices but also trolling the victims. She is becoming a trauma trigger for anybody who has ever been bullied.

Looking over the debian-project mailing list since December 2018, it appears all the most abusive messages, such as the call for dirt on another member, or the public announcement that a member is on probation, have been written by people in a position of leadership or authority, past or present. These people control the infrastructure, they know the messages will reach a lot of people and they intend to preserve them publicly for eternity. That is remarkably similar to the mindset of the men who perpetrate acid attacks on women they can't control.

Therefore, if the leader of an organization repeatedly indulges himself, telling volunteers they are not real developers, has he really made them less of a developer, or has he simply become less of a leader, demoting himself to become one of the despots Lord Denning refers to?

This is a follow-up to the End of Life warning sent earlier this month to confirm that as of today (July 18, 2019), Ubuntu 18.10 is no longer supported. No more package updates will be accepted to 18.10, and it will be archived to old-releases.ubuntu.com in the coming weeks.

The original End of Life warning follows, with upgrade instructions:

Ubuntu announced its 18.10 (Cosmic Cuttlefish) release almost 9 months ago, on October 18, 2018. As a non-LTS release, 18.10 has a 9-month support cycle and, as such, the support period is now nearing its end and Ubuntu 18.10 will reach end of life on Thursday, July 18th.

At that time, Ubuntu Security Notices will no longer include information or updated packages for Ubuntu 18.10.

The supported upgrade path from Ubuntu 18.10 is via Ubuntu 19.04. Instructions and caveats for the upgrade may be found at:

https://help.ubuntu.com/community/DiscoUpgrades

Ubuntu 19.04 continues to be actively supported with security updates and select high-impact bug fixes. Announcements of security updates for Ubuntu releases are sent to the ubuntu-security-announce mailing list, information about which may be found at:

https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Since its launch in October 2004 Ubuntu has become one of the most highly regarded Linux distributions with millions of users in homes, schools, businesses and governments around the world. Ubuntu is Open Source software, costs nothing to download, and users are free to customise or alter their software in order to meet their needs.

Originally posted to the ubuntu-announce mailing list on Fri Jul 19 00:10:53 UTC 2019 by Adam Conrad, on behalf of the Ubuntu Release Team

Version:next-20190719 (linux-next) Released:2019-07-19

joining social media at DebConf19

Two days ago I joined telegram (installed via F-Droid). It was an interesting experience, immediatly I was contacted by people who had shared their addressbook with "the cloud" and thus were notified by the "heavily encrypted" telegram servers.

To quote a friend: "If you upload your address book to 'the cloud', I don't want to be in it." (And while I think so, I'm not angry for past actions. But if would like you to be considerate in the future.)

As an SMS user from 1997 until today it's very interesting to taste some of the same survailance as the rest of the the whole planet. And I have to admit, it's tasty, but consciously I know it's tasty in a bitter-sweet way. What also puzzled me that Telegram chats are unecrypted by default. In 2019.

And now let's do something about it. Or sing this karaoke version of the yellow submarine: we all live in global world surveillance, global world surveillance, global world surveillance! Cheers!

Ubuntu Advantage  for Infrastructure为业内最全面的软件、安全和IaaS提供单一 ，每节点包支持。OpenStack和Kubernetes支持的加入，UA基础设施建设提供了验证未来数据中心所需要的一切。 Ubuntu Advantage也是Canonical为企业所提供的专业技术支持，旨在降低生成环境维护成本，确保企业生产、服务正常运行免除安全威胁。

Ubuntu Advantage 为企业提供安全、合规性支持，在提高效率的同时降低了复杂性和成本支出。Ubuntu Advantage for Infrastructure帮助全球领先的组织管理生产环境中的Ubuntu的部署。（以下简称Ubuntu Advantage为UA）
包含：

• 扩展安全维护更新（ESM）
• Kernel live patch 服务可避免重启
• Landscape内部系统管理工具
• 24×7的电话和ticket支持
• 支持OpenStack，Kubernetes，Ceph/Swift及更多
• 知识库访问
• IP（知识产权）法律支持计划
• 通过FIPS 140-2认证的加密模块和普通标准

扩展安全维护更新（ESM）

扩展的安全维护（ESM）通过UA for Infrastructure确保Ubuntu长期支持（LTS）系统的持续安全性和完整性。

Canonical Ubuntu安全团队将提供Ubuntu main archive上常用的服务器包的高危漏洞、已知的安全风险修复服务。其包含12.04 LTS及14.04 LTS的支持。

Kernel live patch（内核热补丁服务）

Kernel live patch：无需重启即可给内核高危漏洞打补丁，特点如下：

• 无需重启系统即可自动修补安全漏洞
• 减少下载时间，为你的LTS系统增加安全保障
• 已包含在UA for Infrastructure内

UA价格列表：

以下提及到相关价格为2019年7月19日，已包含扩展安全维护更新服务（ESM）。最新价格可访问此页面或者联系我们。

1、虚拟服务器（Virtual Server ）

• 基础版：75美元/年
• 标准版：250美元/年
• 高级版：500美元/年

各版本服务支持描述（上到下对应左到右）

2、物理服务器（Physical Server ）

UＡ服务只能提供给通过Canonical的服务器认证流程的物理服务器。已认证服务器列表见：链接

• 基础版：225美元/年
• 标准版：750美元/年
• 高级版：1500美元/年

各版本服务支持描述（上到下对应左到右）

3、桌面系统（Desktop）

• 基础版：25美元/年（100台起售）
• 标准版：150美元/年（20台起售）
• 高级版：300美元/年（10台起售）

各版本服务支持描述（上到下对应左到右）

更多内容请访问Ubuntu企业支持。如需要其他支持服务，请联系我们。

The post 企业专业支持：Ubuntu Advantage介绍 appeared first on Ubuntu Blog.

Back in 1995 or so, pretty much everyone with a PC did all their work as root. We ran graphics editors, word processors, everything as root. Well, not literally an account named “root”, but the most common DOS, Windows, and Mac operating systems of the day had no effective reduced privilege account.

It was that year that I tried my first Unix. “Wow!” A virus can’t take over my system. My programs are safe!

That turned out to be a little short-sighted.

The fundamental problem we have is that we’d like to give users of a computer more access than we would like to give the computer itself.

Many of us have extremely sensitive data on our systems. Emails to family, medical or bank records, Bitcoin wallets, browsing history, the list goes on. Although we have isolation between our user account and root, we have no isolation between applications that run as our user account. We still, in effect, have to be careful about what attachments we open in email.

Only now it’s worse. You might “npm install hello-world”, and audit hello-world itself, but get some totally malicious code as well. How many times do we see instructions to gem install this, pip install that, go get the other, and even curl | sh? Nowadays our risky click isn’t an email attachment. It’s hosted on Github with a README.md.

Not only that, but my /usr/bin has over 4000 binaries. Have every one been carefully audited? Certainly not, and this is from a distro with some of the highest quality control around. What about the PPAs that people add? The debs or rpms that are installed from the Internet? Are you sure that the postinst scripts — which run as root — aren’t doing anything malicious when you install Oracle Virtualbox?

Wouldn’t it be nice if we could, say, deny access to everything in ~/.ssh or ~/bankstatements except for trusted programs when we want it? On mobile, this happens, to an extent. But we have both a legacy of a different API on desktop, and a much more demanding set of requirements.

It feels like our ecosystem is on the cusp of being able to do this, but none of the options I’ve looked at quite get us there. Let’s take a look at some.

AppArmor

AppArmor falls into the “first line of defense — better than nothing” category. It works by imposing mandatory access controls on a per-executable basis. This starts out as a pretty good idea: we can go after some high-risk targets (Firefox, Chromium, etc) and lock them down. Great! Although it’s not exactly intuitive, with a little configuration, you can prevent them from accessing sensitive areas on disk.

But there’s a problem. Actually, several. To start with, AppArmor does nothing by default. On my system, aa-unconfined --paranoid lists 171 processes that have no policies on them. Among them are Firefox, Apache, ssh, a ton of Pythons, and some stuff I don’t even recognize (/usr/lib/geoclue-2.0/demos/agent? What’s this craziness?)

Worse, since AppArmor matches on executable, all shell scripts would match the /bin/bash profile, all Python programs the Python profile, etc. It’s not so useful for them. While AppArmor does technically have a way to set a default profile, it’s not as useful as you might think.

Then you’re still left with problems like: a PDF viewer should not ordinarily have access to my sensitive files — except when I want to see an old bank statement. This can’t really be expressed in AppArmor.

SELinux

From its documentation, it sounds like SELinux might fit the bill well. It allows transitions into different roles after logging in, which is nice. The problem is complexity. The “notebook” for SELinux is 395 pages. The SELinux homepage has a wiki, which says it’s outdated and replaced by a github link with substantially less information. The Debian wiki page on it is enough to be scary in itself: you need to have various filesystem support, even backups are complicated. Ted T’so had a famous comment about never getting some of his life back, and the Debian wiki also warns that it’s not really tested on desktop systems.

We have certainly learned that complexity is an enemy of good security, leading users to just bypass it. I’m not sure we can rely on it.

Mount Tricks

One thing a person could do would be to keep the sensitive data on a separate, ideally encrypted, filesystem. (Maybe even a fuse one such as gocryptfs.) Then, at least, it could be unavailable for most of the time the system is on.

Of course, the downside here is that it’s still going to be available to everything when it is mounted, and there’s the hassle of mounting, remembering to unmount, password typing, etc. Not exactly transparent.

I wondered if mount namespaces might be an answer here. A filesystem could be mounted but left pretty much unavailable to processes unless a proper mount namespace is joined. Indeed that might be a solution. It is somewhat complicated, though, since nsenter requires root to work. Enter sudo, and dropping privileges back to a particular user — a not particularly ideal situation, and complex as well.

Still, it might well have some promise for some of these things.

Firejail

Firejail is a great idea, but suffers from a lot of the problems that AppArmor does: things must explicitly be selected to run within it.

AppImage and related tools

So now there’s your host distro and your bundled distro, each with libraries that may or may not be secure, both with general access to your home directory. I think this is a recipe for worse security, not better. Add to that the difficulty of making those things work; I know that the Digikam people have been working for months to get sound to work reliably in their AppImage.

Others?

What other ideas are out there? I’ve occasionally created a separate user on the system for running suspicious-ish code, or even a VM or container. That’s a fair bit of work, and provides incomplete protection, but has some benefits. Still, it’s again not going to work for everything.

I hope to play around with many of these tools, especially SELinux, before too long and report back how I’ve found them to be.

Finally, I would like to be really clear that I don’t believe this issue is limited to Debian, or even to Linux. It impacts every desktop platform in wide use today. Actually, I think we’re in a better position to address it than some, but it won’t be easy for anyone.

Neste episódio tivemos a de novo participação do João Jotta e do André Paula do Linuxtechpt onde discutimos práticas de segurança e privacidade e snaps. Já sabes, ouve, subscreve e partilha!

• https://linuxtech.pt/
• https://ubucon.eu
• https://sintra2019.ubucon.org/call-for-papers-announcement/
• https://framaforms.org/volunteers-voluntarios-ubucon-europe-2019-sintra-1559899302

Apoios

Este episódio foi produzido e editado por Alexandre Carrapiço (Thunderclaws Studios – captação, produção, edição, mistura e masterização de som) contacto: thunderclawstudiosPT–arroba–gmail.com.

Outra forma de nos apoiarem é usarem os links de afiliados do Humble Bundle, porque ao usarem esses links para fazer uma compra, uma parte do valor que pagam reverte a favor do Podcast Ubuntu Portugal
E podem obter tudo isso com 15 dólares ou diferentes partes dependendo de pagarem 1, ou 8.
Achamos que isto vale bem mais do que 15 dólares, pelo que se puderem paguem mais um pouco mais visto que têm a opção de pagar o quanto quiserem.

• Sugestão de bundle:

• https://www.humblebundle.com/books/open-source-bookshelf?partner=pup
• https://www.humblebundle.com/books/programmable-boards-make-books?partner=pup

Se estiverem interessados em outros bundles se acrescentarem no fim do link para qualquer bundle: ?partner=pup (da mesma forma como no link da sugestão) e vão estar também a apoiar-nos.

Atribuição e licenças

“Dingo”by PaulBalfe is licensed under CC BY 2.0

A música do genérico é: “Won’t see it comin’ (Feat Aequality & N’sorte d’autruche)”, por Alpha Hydrae e está licenciada nos termos da [CC0 1.0 Universal License](https://creativecommons.org/publicdomain/zero/1.0/).

Este episódio está licenciado nos termos da licença: Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0), cujo texto integral pode ser lido aqui. Estamos abertos a licenciar para permitir outros tipos de utilização, contactem-nos para validação e autorização.