> Welcome to the Ubuntu Weekly Newsletter, Issue 859 for the week of September 22 - 28, 2024. > - Ubuntu Stats > - Hot in Support > - Ubuntu Meeting Activity Reports > - Rocks Public Journal > - LXD: Weekly news #364 > - LoCo Events > - Oracular Oriole (24.10) Release Status Tracking > - CUPS Remote Code Execution Vulnerability Fix Available > - ... > - And much more!
> Here’s what Hoosiers need to know ahead of the voter registration deadline, which is the end of the day on Oct. 7. > The easiest way to register or ensure your registration is still active is online at IndianaVoters.com. There, you can also request an absentee ballot, find your polling place and see who’s on your ballot. > You can also register by mail or in person at your local election administrator’s office. > If you need to register or update your registration, you have to provide some proof of residence. The quickest way to do that is by submitting your driver’s license or state ID number, or the last four digits of your Social Security number. > You can also provide proof of residence via a current utility bill, bank statement, government check, paycheck or government document that shows your name and address.
pnutzh4x0r
Now
•
100%
I still haven't done much of Varlamore Part 1(just some thieving of rich citizens and hunter rumours). With Part 2, I did do the Colossol Wyrm agility course and got the graceful recolor. I have yet to do Moons or the new prayer training.
That said, I did try out Hueycotl with some friends and... it was kinda lacking. The fight is long and the drops are not good. I know they recently buffed the drop table a bit, but I'm not in a rush to go back... Which is fine, I still have lots of things to do (ie. I just finished Sins of the Father and am now working on the Elite Varrock diary).
9to5linux.com
> The Linux Mint 22.1 distribution was slated for release in December 2024 with a revamped Cinnamon theme and better package management. > Slated for release in December 2024, near the Christmas holidays, Linux Mint 22.1 will ship with the soon-to-be-released Cinnamon 6.4 desktop environment featuring a revamped theme that’s much darker and contrasted than before, rounded elements, redesigned dialogs, and a gap between the applets and the panel. More from the Mint Monthly News: [September 2024](https://blog.linuxmint.com/?p=4749) > The transition towards Aptkit and Captain is now finished. Starting with Linux Mint 22.1, set to be released this December, none of our projects will depend on aptdaemon, synaptic, gdebi or apturl anymore.
pnutzh4x0r
Now
•
100%
I think the "Ubuntu Core 22" means it is the snap based version of Steam rather than the deb version.
If you look at the snapcraft.yaml for the Steam snap, it uses core22 as its base.
> Exploit of a combination of several bugs - Overhyped but not that severe - Fixes already available ... > Canonical’s security team has acted immediately to quickly apply the patches which Michael Sweet (author and maintainer of CUPS) had already prepared for CUPS, cups-browsed, libcups-filters, libppd, and cups-filters (in the time from the first report until then I was some days off and I was also on the Open Source Summit Europe, thanks, Michael Sweet, for stepping in, also thanks to Zdenek Dohnal from Red Hat) to the appropriate in all supported Ubuntu versions, so that at the time of disclosure most fixes were already in place. They also reported in an Ubuntu blog. They tell users what to do, from turning off cups-browsed or at least its legacy CUPS browsing support to updating their systems as the fixes were already available. Thanks a lot to Seth Arnold, Marc Deslauriers, Diogo Sousa, Mark Esler, Luci Stanescu, and more. ... > The X post really overhyped the vulnerability. Attacks from the internet are not very probable due to the fact that servers on the internet do not have cups-browsed and CUPS installed and CUPS/cups-browsed setups are there usually only in NAT-protected local networks with desktop machines and print servers. And the remote code execution is also rather restricted, as CUPS filters are not running as root, but as the system user “lp” which cannot even read user’s home directories. In addition, the remote code execution only happens when a user actually prints a job on the fake printer. Actually assigned scores ended up between 8.4 and 9.1.
ubuntu.com
> Canonical’s security team has released updates for the cups-browsed, cups-filters, libcupsfilters and libppd packages for all Ubuntu LTS releases under standard support. The updates remediate CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, while CVE-2024-47177 is addressed by the other 3 vulnerabilities being patched. Information on the affected versions can be found in the CVE pages linked above. If you have any of these installed, our recommendation is to update as soon as possible. Read on to learn more about the details. Security updates for ESM releases will be released shortly.
pnutzh4x0r
Now
•
90%
Looks like a number of patches are landing in Ubuntu to address this: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/2082335
Update: CUPS Remote Code Execution Vulnerability Fix Available
www.phoronix.com
> There's been talk of this unauthenticated RCE vulnerability coming with a CVSS 9.9 rating but none of the technical details were publicly known until it was made public just now at the top of the hour. Simone Margaritelli discovered this vulnerability and has shared a write-up around this potentially very impactful Linux vulnerability. > This vulnerability, fortunately, doesn't affect the Linux kernel but rather CUPS... The print server commonly used on Linux systems and other platforms. ... From [Attacking UNIX Systems via CUPS, Part I](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/): > "A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer)." ... > This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall. LAN attacks are also possible via spoofing zeroconf / mDNS / DNS-SD advertisements. > Besides CUPS being used on Linux distributions, it also affects some BSDs, Oracle Solaris, Google Chrome OS, and others. > As of writing there is no Linux fix available for this high profile security issue. In the meantime it's recommended to disable and remove the "cups-browsed" service, updating CUPS, or at least blocking all traffic to UDP port 631.
blog.system76.com
cross-posted from: https://lemmy.ndlug.org/post/1167059 > COSMIC’s Alpha 2 release builds upon that work with functionality built out for Files, additional Settings pages, considerable infrastructure work for screen reader support+, and some highly requested window management features. System76 is ecstatic at the level of excitement and collaboration so far with alpha testers and early app & applet developers, and we look forward to seeing what comes from these new additions. ... > The second COSMIC alpha will be released on September 26th. Those participating in Alpha 1 on Pop!_OS can simply update through the COSMIC App Store to transition. This alpha will be followed by monthly alpha releases until all core features have been built out. More coverage: - [COSMIC DE Alpha 2 Released, This is What’s New](https://www.omgubuntu.co.uk/2024/09/cosmic-desktop-alpha-2-pop-os-released) - [COSMIC Alpha 2 Released with Bluetooth Settings, Much-Improved File Manager](https://9to5linux.com/cosmic-alpha-2-released-with-bluetooth-settings-much-improved-file-manager) - [Cosmic Desktop Alpha 2: BIG PROGRESS for a month of work!](https://www.youtube.com/watch?v=srXzV0hkjXI)
blog.system76.com
> COSMIC’s Alpha 2 release builds upon that work with functionality built out for Files, additional Settings pages, considerable infrastructure work for screen reader support+, and some highly requested window management features. System76 is ecstatic at the level of excitement and collaboration so far with alpha testers and early app & applet developers, and we look forward to seeing what comes from these new additions. ... > The second COSMIC alpha will be released on September 26th. Those participating in Alpha 1 on Pop!_OS can simply update through the COSMIC App Store to transition. This alpha will be followed by monthly alpha releases until all core features have been built out. More coverage: - [COSMIC DE Alpha 2 Released, This is What’s New](https://www.omgubuntu.co.uk/2024/09/cosmic-desktop-alpha-2-pop-os-released) - [COSMIC Alpha 2 Released with Bluetooth Settings, Much-Improved File Manager](https://9to5linux.com/cosmic-alpha-2-released-with-bluetooth-settings-much-improved-file-manager) - [Cosmic Desktop Alpha 2: BIG PROGRESS for a month of work!](https://www.youtube.com/watch?v=srXzV0hkjXI)
www.theverge.com
> Mozilla has overhauled its branding to pay homage to its Netscape roots and better distinguish the wider organization from its Firefox web browser. The most notable change is to the company’s logo: what was previously a sans-serif wordmark styled as “Moz://a” has been updated to correctly spell out the Mozilla name, featuring a new customized typeface and an M-shaped flag. > According to Mozilla, the flag symbolizes the brand’s “activist spirit.” That fits with the image that the Mozilla Foundation, which is leading the company, is attempting to build: describing itself as “a non-profit organization that promotes openness, innovation, and participation on the Internet” and regularly releasing privacy reports that investigate tech companies’ policy and security practices.
> Welcome to the Ubuntu Weekly Newsletter, Issue 858 for the week of September 15 - 21, 2024. > - Ubuntu 24.10 (Oracular Oriole) Beta released > - Welcome New Members and Developers > - Ubuntu Stats > - Hot in Support > - Ubuntu Meeting Activity Reports > - Ubuntu Flavor sync meeting notes: 9 September 2024 > - UbuCon Asia 2024 Team meeting 2024-09-15 12:00 UTC > - Ubuntu Home Server Workshop 2024 @Busan > - Ubucon Portugal 2024 needs you! > - LoCo Events > - Mir release 2.18.0 > - Call for testing: ubuntu-frame, mir-test-tools on the 22 track (Mir 2.17.2 update) > - Ubuntu Desktop’s 24.10 Dev Cycle - Part 6: September Update > - ... > - And much more!
blog.tidelift.com
cross-posted from: https://lemmy.ndlug.org/post/1153465 > In the second finding of the 2024 Tidelift state of the open source maintainer survey, we found that the more maintainers are paid, the more improvements they make to their projects. ... > In the previous finding, we reported that 60% of maintainers describe themselves as unpaid hobbyists, and 36% of maintainers describe themselves as paid (professional or semi-professional) maintainers, earning some or all of their income from their open source work. ... > When you break down the paid maintainers into professional (earning most or all of their income from their maintenance work) and semi-professional (earning some of their income from maintaining projects), it becomes clear that the amount of money a maintainer is making for their work has a large impact on the types of improvements they are able to make. Across nearly all major categories, professional maintainers are on average over 20 percentage points more likely to make key improvements to their projects than semi-professional maintainers. ... > In the previous study, 81% percent of professional maintainers earning most or all of their income from maintaining projects spend more than 20 hours a week maintaining their projects. This year, the percentage was nearly identical (82%). > Conversely, in last year’s survey, we found that the vast majority of unpaid hobbyists spend ten hours or less per week on their maintenance work (81%). This percentage also stayed consistent in this year’s survey, with 78% of unpaid hobbyist maintainers working ten hours or less per week. ... > We’ve heard from many maintainers that how they are paid for their work also matters. For many maintainers there is a huge difference between getting a one-time “airdrop” of money, perhaps right after a high profile incident where people are paying attention to their projects, compared to ongoing recurring income that they can count on. So this year for the first time we asked maintainers to tell us whether they would prefer to get predictable monthly income or a one-time lump payment. > An overwhelming majority of maintainers prefer to receive predictable monthly income, with 81% choosing that option.
blog.tidelift.com
> In the second finding of the 2024 Tidelift state of the open source maintainer survey, we found that the more maintainers are paid, the more improvements they make to their projects. ... > In the previous finding, we reported that 60% of maintainers describe themselves as unpaid hobbyists, and 36% of maintainers describe themselves as paid (professional or semi-professional) maintainers, earning some or all of their income from their open source work. ... > When you break down the paid maintainers into professional (earning most or all of their income from their maintenance work) and semi-professional (earning some of their income from maintaining projects), it becomes clear that the amount of money a maintainer is making for their work has a large impact on the types of improvements they are able to make. Across nearly all major categories, professional maintainers are on average over 20 percentage points more likely to make key improvements to their projects than semi-professional maintainers. ... > In the previous study, 81% percent of professional maintainers earning most or all of their income from maintaining projects spend more than 20 hours a week maintaining their projects. This year, the percentage was nearly identical (82%). > Conversely, in last year’s survey, we found that the vast majority of unpaid hobbyists spend ten hours or less per week on their maintenance work (81%). This percentage also stayed consistent in this year’s survey, with 78% of unpaid hobbyist maintainers working ten hours or less per week. ... > We’ve heard from many maintainers that how they are paid for their work also matters. For many maintainers there is a huge difference between getting a one-time “airdrop” of money, perhaps right after a high profile incident where people are paying attention to their projects, compared to ongoing recurring income that they can count on. So this year for the first time we asked maintainers to tell us whether they would prefer to get predictable monthly income or a one-time lump payment. > An overwhelming majority of maintainers prefer to receive predictable monthly income, with 81% choosing that option.
element.io
> Element is launching the world’s first communications platform based on the upcoming Matrix 2.0 release. The result is blazing performance which outperforms the mainstream alternatives - across a decentralised system that enables self-hosting and end-to-end encryption - as well as open standard interoperability to revolutionise real time communication between large organisations. > Built on Matrix 2.0, Element X now rivals the performance of centralised consumer messaging apps, empowering organisations to address the shadow IT issues caused by consumer-grade messaging apps in the workplace. > The new Element communications solution consists: > - Element X, our next-gen app with an array of new features > - Element Call fully integrated into Element X, for native Matrix-encrypted voice and video > - Element Server Suite, our backend hosting solution for powerful admin control and Matrix 2.0 performance
9to5linux.com
> GNOME 46.5 is now available as the fifth maintenance update to the GNOME 46 desktop environment series with more bug fixes and improvements. ... > GNOME 46.5 is here five weeks after the GNOME 46.4 release and fixes smartcard logins, adds user permissions to new Wi-Fi connections for restricted users, fixes the showing of pending PAM messages on the login screen, and fixes the “Locate Pointer” accessibility option when the “Reduce Animation” option is turned on. > It also fixes several issues in the Mutter window and composite manager, including drag and drop between X11 and Wayland clients, drag and drop from grabbing pop-ups, EGLDevice support, frozen cursor on some hybrid machines, tablet input in maximized windows, frozen cursor after suspend, using modifiers on multi-GPU setups, propagating tablet device removals to clients, and touch window dragging with pointer lock enabled.
vivaldi.com
> Today, we’re thrilled to announce that Vivaldi is officially available for download as a Snap package, bringing our powerful, customizable browser to even more Linux users.
> Ubuntu 24.10 ‘Oracular Oriole’ will be released on October 13th, and as you’d expect from a new version of Ubuntu, it’s packed with new features. ... > - GNOME 47 Included > - New File Manager Features > - Disk Usage Analyser > - New & Expanded Settings > - Ubuntu Dock Changes > - Ubuntu Anniversary Touches > - New Set of Wallpapers > - New Security Center App > - NVIDIA Defaults to Wayland > - Better Fingerprint Support > - SysProf & Kdump-Tools Preinstalled > - New Look APT > - Linux Kernel 6.11 > - Power Efficiency Boost > - Updated Software & Tooling
pnutzh4x0r
Now
•
100%
This is a great summary. Thanks!
> Linus Torvalds Speaks on the the divide between Rust and C Linux developers an the future Linux. Will things like fragmentation among the open source community hurt the Linux Kernel? We'll listen to the Creator of Linux. For the full key note, checkout: [Keynote: Linus Torvalds in Conversation with Dirk Hohndel](https://www.youtube.com/watch?v=OM_8UOPFpqE) The Register's summary: [Torvalds weighs in on 'nasty' Rust vs C for Linux debate](https://www.theregister.com/2024/09/19/torvalds_talks_rust_in_linux/)
fosstodon.org
> COSMIC Alpha 2 is landing on September 26th. Repositories will be tagged with the new release for distribution packagers. > Pop!_OS 24.04 Alpha 2 ISO's will also be available for download! #COSMICdesktop #COSMICDE
www.omgubuntu.co.uk
> When you install a PWA1 in the Chromium snap you might expect it to open it in a separate, streamlined window when you open it using its shortcut in the applications grid. > Presently, PWAs in the Chromim Snap don’t get detected as separate instances by GNOME Shell. This means no separate dock icon (it is grouped into Chromium’s) and it is not treated as a separate app by the task switcher, making it difficult to alt/super + tab to it. ... > Oracular carries an Ubuntu-specific chromium-snap-pwa.patch to GNOME Shell. > This patch ensures that PWA windows from the Chromium snap are handled per users expectations: their own dock icon, and their own entry in app switcher. > The plan is to back-port this patch to Ubuntu 24.04 LTS too, so keep an eye out for that.
news.itsfoss.com
> Primarily written in the Go programming language, Authd is an authentication service for Ubuntu 24.04 LTS that has been introduced to simplify the needs of organizations and individuals looking to use identity management services. > At launch, Authd supports OIDC, with Microsoft's Entra ID being the first supported identity provider. As demonstrated by the screenshot above, Ubuntu was showing an authentication prompt to log in to a service equipped with Entra ID. > Authd can be used to log in through the GNOME Display Manager (GDM), or via Secure Shell (SSH). It has a modular design that makes it effortless to integrate with cloud services. > Canonical also intends to introduce more identity providers in the near future, with plans to also have a white-label OIDC provider (allows wider customization) in the mix.
pnutzh4x0r
Now
•
100%
It looks like you are running XFCE instead of GNOME (the normal Ubuntu desktop). I'm not sure how that happened... but you an always just install another desktop.
For instance, you can try to make sure you have the ubuntu-desktop or ubuntu-desktop-minimal metapackage installed:
sudo apt install ubuntu-desktop-minimal
After that, the login manager should allow you to select the Ubuntu session rather than the XFCE one.
pnutzh4x0r
Now
•
100%
pnutzh4x0r
Now
•
100%
I wrote a Python script to parse the data and convert into RGB values. Here are the light mode values:
blue 00496c
red a0252b
green 3b6e43
yellow 966800
bright_green 00572c
bright_red 880418
bright_orange 782c00
ext_warm_grey 9b8e8a
ext_orange fab86c
ext_yellow f6e062
ext_blue 6acad8
ext_purple d48cff
ext_pink ff9bdd
ext_indigo 95c4fc
accent_blue 00525a
accent_red 78292e
accent_green 185529
accent_warm_grey 554742
accent_orange 624000
accent_yellow 534800
accent_purple 68217b
accent_pink 860439
accent_indigo 2e496c
Here are the dark mode values:
blue 94ebeb
red ffb5b5
green abf6d1
yellow fff19e
bright_green 5edb8c
bright_red ffa090
bright_orange ffa37d
ext_warm_grey 9b8e8a
ext_orange ffad00
ext_yellow fddb40
ext_blue 48b9c7
ext_purple ce7dff
ext_pink f93983
ext_indigo 3e88ff
accent_blue 63d0de
accent_red fca1a0
accent_green 92ce9b
accent_warm_grey cabab4
accent_orange ffad00
accent_yellow f6e062
accent_purple e79bfd
accent_pink ff9bb1
accent_indigo a1c0eb
pnutzh4x0r
Now
•
100%
They have the RGB values as decimals in the light.ron and dark.ron files here: https://github.com/pop-os/libcosmic/blob/master/cosmic-theme/src/model/
You would need to convert the numbers to hexadecimal manually.
pnutzh4x0r
Now
•
100%
Yes, based on the diagrams on their blog, it looks like this only impacts Snaps.
pnutzh4x0r
Now
•
100%
From the Discourse Blog:
The Linux desktop provides XDG Desktop Portals as a standardised way for applications to access resources that are outside of the sandbox. Applications that have been updated to use XDG Desktop Portals will continue to use them. Prompting is not intended to replace XDG Desktop Portals but to complement them by providing the desktop an alternative way to ask the user for permission. Either when an application has not been updated to use XDG Desktop Portals, or when it makes access requests not covered by XDG Desktop Portals.
Since prompting works at the syscall level, it does not require an application’s awareness or cooperation to work and extends the set of applications that can be run inside of a sandbox, allowing for a safer desktop. It is designed to enable desktop applications to take full advantage of snap packaging that might otherwise require classic confinement.
So this looks like it complements and not replaces the XDG Desktop Portals, especially for applications that have not implemented the Portals. It allows you to still run those applications in confinement while providing some more granular access controls.
pnutzh4x0r
Now
•
100%
From what I can tell, Pop!_OS does not ship their own version of timeshift. Instead, it comes directly from Ubuntu. So if there is a change in maintainers, it should be reported to Ubuntu:
pnutzh4x0r
Now
•
100%
As a moderator, you should see a "shield" on a post and from that sub-menu, you can choose to feature or unfeature a post:
pnutzh4x0r
Now
•
100%
I used to use VLC for music, but these days I use Symphony to play local files on my phone. VLC tended to struggle when scanning or indexing large folders (which it did all the time...), while Symphony is a bit better at that. That said, I still use VLC for video and for casting things from my DLNA server (VLC supports Chromecast).
For ebooks, I've used Librera FD and that has been mostly OK. I'll checkout the two you mentioned though. Thanks!
pnutzh4x0r
Now
•
100%
On Ubuntu, there is a program called "Firmware Updater" which uses LVFS to retrieve and install firmware updates (including BIOS/UEFI).
According to this page: https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN23ETXXW.firmware your Carbon X1 Gen 6 should be supported.
pnutzh4x0r
Now
•
100%
Holy hurdle! TY J-LOVE!
pnutzh4x0r
Now
•
100%
All my servers moved to 24.04 and I wanted my desktop to keep in line with them (so they all had the same packages). Likewise, I've been following the development of GNOME and I really liked what they have done with versions 45 and 46, so I wanted to try a more modern version of that desktop environment (Pop 22.04 is still on GNOME 42 and is now missing out on some cool features like the quick settings menu).
Finally, I wanted to try out Wayland and the experience on Pop 22.04 is not great with Wayland, especially since it is missing out on the more recent fixes and updates in Ubuntu 24.04.
If you are happy with Pop 22.04 and willing to wait for COSMIC to stabilize and become feature complete, then that is what you should do. For me, I used this delay in releasing Pop 24.04 as an opportunity to try out something different and for the most part, I'm pretty happy with the experience.
pnutzh4x0r
Now
•
100%
Unfortunately, there will not be a release of Pop 24.04 with GNOME before COSMIC is released. In fact, System76 has stopped development of Pop-shell as referenced here:
https://reddit.com/r/pop_os/comments/1eo59wj/will_xorg_still_be_an_option_in_2404/
Once, Pop 24.04 is released, you will be able to install gnome-session to get GNOME, but it will be the version from Ubuntu and not Pop-shell (though you can install the unsupported extension yourself).
Basically, the development of COSMIC is delaying the release of Pop 24.04... which means the whole distro update probably won't come until 2025 as the desktop matures.
For this reason, among others, I've decided to switch to Ubuntu until COSMIC matures and Pop 24.04 is released.
pnutzh4x0r
Now
•
100%
I think you meant Pop!_OS (is developed by System76). TuxedoOS is developed by Tuxedo Computers, which is a European Linux focused hardware company.
That said, the point stands... there are hardware companies making Linux supported devices.
pnutzh4x0r
Now
•
100%
The default "App Center" does not support flatpaks (only snaps). However, if you install the GNOME software center with the suggested dependencies:
$ sudo apt install --install-suggests gnome-software
Then you will be able to install flatpaks, debs, and snaps.
pnutzh4x0r
Now
•
100%
If you are using Pop!_OS 22.04, then you are using gdm. You can just create the file if it doesn't exist.
Now