For me reading this post took about 10 minutes since I not only read but I also processed and checked references and I tooted about it immediately
It is quite sobering to read something this horrific happening in an Open Source project of this magnitude of volume
This is something you would expect in closed source not open source; it's like a shower with 0° degrees Celsius of water flowing over you 0° in the depth of the coldest Siberian winter
At the beginning of this year we noticed that the Deepin Desktop as it is currently packaged in openSUSE relies on a packaging policy violation to bypass SUSE security team review restrictions.
This is where the depth of the deception became clear
>>
The review of this component was also what led us to the discovery of the deepin-feature-enable whitelisting bypass, since we installed the full Deepin desktop environment for the first time in a long time, which triggered the “license agreement” dialog described above. After finding out about this, we decided that it was time to reassess the overall topic of Deepin in openSUSE based on our long-standing experiences.
Sadly the review of deepin-app-services was another chaotic case, one that is actually still unfinished. Even understanding the purpose of this D-Bus service was difficult, because there wasn’t really any design documentation or purpose description of the component. From looking at the D-Bus service implementation, we judged that it is a kind of system wide configuration store for Deepin. Contrary to most other Deepin D-Bus services, this one is not running as root but as a dedicated unprivileged service user.
<<
This reads like a horror novel but it's actually happening! Unbelievable how this has harmed a distro with many dedicated users!
At the beginning of this year we noticed that the Deepin Desktop as it is currently packaged in openSUSE relies on a packaging policy violation to bypass SUSE security team review restrictions.
After a longer time of standstill regarding Deepin reviews, a request for the addition of deepin-api-proxy arrived. This package greeted us with over two dozen D-Bus configuration files. Again, upstream’s description of what the component is supposed to do was very terse. From looking at the implementation we deduced that the proxy component seems to be related to the renaming of interfaces described in the previous section.
We found a design flaw in the proxy’s design which allowed a local root exploit. You can find the details in a dedicated blog post we published about this not too long ago.
It is noteworthy that the communication with upstream proved very difficult during the coordinated disclosure process we started for this finding. We did not get timely responses, which nearly led us to a one-sided publication of the report, until upstream finally expressed their wish to follow coordinated disclosure at the very last moment.
<
... show more
This part I screen capped for accentuation
>>
2024-08-29: deepin-api-proxy: D-Bus Service
After a longer time of standstill regarding Deepin reviews, a request for the addition of deepin-api-proxy arrived. This package greeted us with over two dozen D-Bus configuration files. Again, upstream’s description of what the component is supposed to do was very terse. From looking at the implementation we deduced that the proxy component seems to be related to the renaming of interfaces described in the previous section.
We found a design flaw in the proxy’s design which allowed a local root exploit. You can find the details in a dedicated blog post we published about this not too long ago.
It is noteworthy that the communication with upstream proved very difficult during the coordinated disclosure process we started for this finding. We did not get timely responses, which nearly led us to a one-sided publication of the report, until upstream finally expressed their wish to follow coordinated disclosure at the very last moment.
Excerpt from linked site >> After reviewing the main D-Bus service, we could not help ourselves but call it a security nightmare. The service methods were not only unauthenticated and thus accessible to all users in the system, but the D-Bus configuration file also allowed anybody to own the D-Bus service path on the system bus, which could lead to impersonation of the daemon. Among other issues, the D-Bus service allowed anybody in the system to create arbitrary new UNIX groups, add arbitrary users to arbitrary groups, set arbitrary users’ Samba passwords or overwrite almost any file on the system by invoking mkfs on them as root, leading to data loss and denial-of-service. The daemon did contain some Polkit authentication code, but it was all found in unused code paths; to top it all off, this code used the deprecated UnixProcess Polkit subject in an unsafe way, which would make it vulnerable to race conditions allowing authentication bypass, if it had been used. <<
¿WTF?
... show more
The Deepin frightmare
Excerpt from linked site >> After reviewing the main D-Bus service, we could not help ourselves but call it a security nightmare. The service methods were not only unauthenticated and thus accessible to all users in the system, but the D-Bus configuration file also allowed anybody to own the D-Bus service path on the system bus, which could lead to impersonation of the daemon. Among other issues, the D-Bus service allowed anybody in the system to create arbitrary new UNIX groups, add arbitrary users to arbitrary groups, set arbitrary users’ Samba passwords or overwrite almost any file on the system by invoking mkfs on them as root, leading to data loss and denial-of-service. The daemon did contain some Polkit authentication code, but it was all found in unused code paths; to top it all off, this code used the deprecated UnixProcess Polkit subject in an unsafe way, which would make it vulnerable to race conditions allowing authentication bypass, if it had been used. <<
At the beginning of this year we noticed that the Deepin Desktop as it is currently packaged in openSUSE relies on a packaging policy violation to bypass SUSE security team review restrictions.
The KDE team has created a wonderful Network for your Androids it's called Konnect and the things that it can do are so various that I'll just show you one of them in the included photographs
The ease with which I can control a music 🎵 player that works on one Android from all my devices which run Konnect opens up possibilities which are just marvelous for a sound engineer like me
Not only is one German state moving from Microsoft to LibreOffice, but the whole federal government is committing to move to open standards by 2027: blog.documentfoundation.org/bl…
Digital sovereignty is becoming vitally important. If governments and organisations use proprietary or pseudo-standard formats, they limit the tools that citizens can use to access data.
The following command will be a video that plays at half speed with audio that's both slowed down and pitched down by an octave.
Note: To enable compilation of this filter, you need to configure FFmpeg with `--enable-librubberband`.
I still need some more feel at home config help. As you can see here I love having vertical gradients on my displays, but in KDE and Vallpaper I have not found how I can set gradients on the side of my wallpaper which are deliberately not 16:9 since I love to look at (vertical) gradients. Where do I need to look to achieve that? Is there a KDE action that I need to define for all my 20 KDE desktops?
In 2005, Google paid $50 million to a software engineer called Andy Rubin, together with his team for a dying phone company giving away their FREE software.
Critics called it the "dumbest acquisition ever." Today, that "dumb decision" is worth over $500 BILLION and is the reason why you are holding a less expensive but quality phone that is not an iPhone
Here's how Google saw the future before anyone else: and built the world's most used mobile device - Android phones
It all started with a tiny company called Android Inc.
Founded by 4 top tech entrepreneurs and business executives, Led by Andy Rubin.
Their goal? To create smarter mobile devices that are more aware of their owner's location and preferences, and an operating system that is completely free & open-source.
Any manufacturer could use, modify, or make it their own. But at this time, this seemed insane.
Because the company was struggling financially:
No products. No revenue. Just 4 guys and a dream. To make it worse, the mobile phone industry was locked
... show more
In 2005, Google paid $50 million to a software engineer called Andy Rubin, together with his team for a dying phone company giving away their FREE software.
Critics called it the "dumbest acquisition ever." Today, that "dumb decision" is worth over $500 BILLION and is the reason why you are holding a less expensive but quality phone that is not an iPhone
Here's how Google saw the future before anyone else: and built the world's most used mobile device - Android phones
It all started with a tiny company called Android Inc.
Founded by 4 top tech entrepreneurs and business executives, Led by Andy Rubin.
Their goal? To create smarter mobile devices that are more aware of their owner's location and preferences, and an operating system that is completely free & open-source.
Any manufacturer could use, modify, or make it their own. But at this time, this seemed insane.
Because the company was struggling financially:
No products. No revenue. Just 4 guys and a dream. To make it worse, the mobile phone industry was locked down tight by software giants:
• Nokia controlled its software • Microsoft charged for Windows Mobile • BlackBerry kept everything in-house
The idea of giving away a free Mobile phone Operating system (OS) was Laughable.
But Google, just as they saw the future of YouTube, saw something much bigger - Mobile phones would become the primary way people access the internet. With that google search engine will be irresistible
They weren't buying software. They were buying the future of computing.
To protect their search engine business, they pushed to buy
This was the real threat: If Microsoft or Nokia dominated mobile, they could: • Block Google Search • Push their own services • Control the future of digital advertising
Google couldn't let that happen.
So they made their boldest move yet. Buy out the entire company, not just the product.
But they didn't just buy Android. They kept it open-source. Why? This was genius because they wanted: • To give Phone makers free software, • help Android developers get a free platform • Help Users have more choices.
Result? Companies like Samsung, Huawei, HTC can distribute their Android devices freely
Everyone won...
Except Google's competitors. 😁 Blackberry Nokia Microsoft Because within 10 years of Android's free open-source purchase, their company was gone.
wondering why you have not seen them again today. Cos' everyone prefers an open-source free phone where you don't have to pay for anything after the initial purchase.
That's the masterstroke In 2008, the first Android phone was launched;
The HTC Dream (T-Mobile G1)
It wasn't pretty. It wasn't smooth.
But it was the beginning of a revolution... Because Google did something unprecedented: They gave manufacturers complete freedom:
• Change the interface • Add new features • Customize everything This sparked an explosion of innovation...
Companies like Samsung, HTC, LG, and others could now compete with Apple without building an OS from scratch.
The result?
Android powers 71% of all smartphones worldwide.
That's billions of devices running Google's software. But here's what makes this truly genius:
In everything Google builds, it always finds a way to monetize.
How does Google make money from its $50 million investment?
The truth is, Google doesn't make money from Android directly. Instead, they make money from: • Play Store fees • Google Search • Digital advertising • User data The platform is free, but the ecosystem is priceless.
This $50M bet didn't just transform mobile. It transformed how we: • Connect • Shop • Work • Live
The lesson? Sometimes the biggest opportunities look like the riskiest bets. Google's Android gamble teaches us: The best investments aren't about what something is today. They're about what something could become tomorrow. And sometimes, giving away value is the best way to capture it.
Im starting to achieve platform distro OS translucency regarding more and more projects. Now I can smoothly work in my hugo projects from any distro I want in Linux. All I need to do is keep the copies I work on in sync. Since I dont run zfs jet on a centralized HDD / SSD I simply use mc -a to do the job manually. Normally it should be trivial, but the hugo projects want rm -Rf dir otherwise old files with similar size can be changed, thus screwing up continuity
Since my KDE MX install is moothing out in cfg features I need, which is a combo of XFce components and KDE, I can smoothly switch to the KDE distro and work further while I tune it.
I chose to keep XFce seperate from KDE distro wise due to size constraints I;ve put on my boot partition
When was the last time you paid close attention to warnings in a partition Management program? You don't remember? I'm going to tell you beautiful story. Jerry has his data on an SSD. Being the power user is Jerry totally disregarded the fact that he had to make a backup of his data. Jerry wanted to use a partition management program like the one I have included in the photograph I've just made.
He took a few precautions, made sure that he wasn't any browser, made sure that he wasn't on the internet, hell he even plugged out his internet router.
One thing Jerry did not anticipate was a catastrophic failure of a piece of critical hardware in his beautiful computer. His gorgeous AMD processor had damage, heat damage
TSC = unstable His GPU integrated in his CPU also had heat damage. When he makes certain simple moves, like moving a window, the GPU goes haywire, sends bad data to the CPU with the unstable TSC and everything cascades down, resulting in a beautiful green screen which Jerry had seen hundreds to thousands of times. These screens usually occurred on
... show more
When was the last time you paid close attention to warnings in a partition Management program? You don't remember? I'm going to tell you beautiful story. Jerry has his data on an SSD. Being the power user is Jerry totally disregarded the fact that he had to make a backup of his data. Jerry wanted to use a partition management program like the one I have included in the photograph I've just made.
He took a few precautions, made sure that he wasn't any browser, made sure that he wasn't on the internet, hell he even plugged out his internet router.
One thing Jerry did not anticipate was a catastrophic failure of a piece of critical hardware in his beautiful computer. His gorgeous AMD processor had damage, heat damage
TSC = unstable His GPU integrated in his CPU also had heat damage. When he makes certain simple moves, like moving a window, the GPU goes haywire, sends bad data to the CPU with the unstable TSC and everything cascades down, resulting in a beautiful green screen which Jerry had seen hundreds to thousands of times. These screens usually occurred only when Jerry had opened a browser. Jerry figured he was safe since he had not opened a browser since this session of the Operating System had started
**Wrong**
In the middle of operation that I have just described in the photograph in fact at the beginning within just the second minute of the operation that needs two to three hours, the machine did not crash to green screen, it terminated his Xsession effectively destroying his partition editor.
Jerry was flabbergasted something he had not anticipated
All his data was lost
Since he was not running ZFS, there was no way that he could restore or roll back a snapshot
A critical shared Library that's used by FFMpeg and of course also used by MPlayer was not in the installation. It was an odd because even a remove reinstall of FFMpeg didn't fix the problem.
Since I'm in no mood to install a development environment from the command line to compile FFMpeg from scratch I just wiped the KDE distro and started all over.
While I was busy with the new installation so I was on the live ISO FFMPEG worked just fine and the library was there working perfectly.
You can already guess what happened when I booted into the new installation.
FFMPEG was installed by default by the distribution, since VLC is installed by default, but the shared library was missing!
¡WTF!
Then I encountered even more bugs, privilege escalation errors!
These bugs and errors have nothing to do with KDE!
They have to do with problems with the distribution from the perspective of my maintainer. It is my task to see if I can reproduce the problems after I fix them by hand if that does not ta
... show more
I've encountered an annoying problem
A critical shared Library that's used by FFMpeg and of course also used by MPlayer was not in the installation. It was an odd because even a remove reinstall of FFMpeg didn't fix the problem.
Since I'm in no mood to install a development environment from the command line to compile FFMpeg from scratch I just wiped the KDE distro and started all over.
While I was busy with the new installation so I was on the live ISO FFMPEG worked just fine and the library was there working perfectly.
You can already guess what happened when I booted into the new installation.
FFMPEG was installed by default by the distribution, since VLC is installed by default, but the shared library was missing!
¡WTF!
Then I encountered even more bugs, privilege escalation errors!
These bugs and errors have nothing to do with KDE!
They have to do with problems with the distribution from the perspective of my maintainer. It is my task to see if I can reproduce the problems after I fix them by hand if that does not take too much time and effort.
The next step was to config KDE connect in this KDE. Luckily I know that I need gufw to migrate my profile, from the xFce MX linux to this KDE MX linux. It was a matter of installing gufw, which is not default in KDE distro, since it has its own nice interface. For me sticking with what I know is the easiest since I want to drive KDE on desktop again after so many decades, even though XFce is still going to be used most, due to shortcut muscle memory
I also encountered another problem; I can immediately tell you that it's not a KDE specific problem but it popped up in konsole.
The subject is fonts and the section is point size. The monitors I use are not of a small resolution. In fact an ideal IPS LED panel layout for me would be an 8K panel two 4K panels flanking it and two 1080p ultra ultra wide panels at a left and right of those.
With such a setup I can monitor different machines at the glance and control them with ease.
Even on my 1080p Ultra Ultra wide panel the default Point sizes for fonts are too small. On a scratch KDE based MX Linux installation, the following problem was repeated twice in Konsole.
The first time I changed font point sizes, closed konsole. When I reopened konsole the fixed with font, was replaced with one that appended spaces behind every couple of letters.
This rendered konsole unusable for work.
Changing the fonts Point sizes to the defaults again did not fix the problem. Sinds that installation was Vanilla and didn't have enough space for home and root on on
... show more
I also encountered another problem; I can immediately tell you that it's not a KDE specific problem but it popped up in konsole.
The subject is fonts and the section is point size. The monitors I use are not of a small resolution. In fact an ideal IPS LED panel layout for me would be an 8K panel two 4K panels flanking it and two 1080p ultra ultra wide panels at a left and right of those.
With such a setup I can monitor different machines at the glance and control them with ease.
Even on my 1080p Ultra Ultra wide panel the default Point sizes for fonts are too small. On a scratch KDE based MX Linux installation, the following problem was repeated twice in Konsole.
The first time I changed font point sizes, closed konsole. When I reopened konsole the fixed with font, was replaced with one that appended spaces behind every couple of letters.
This rendered konsole unusable for work.
Changing the fonts Point sizes to the defaults again did not fix the problem. Sinds that installation was Vanilla and didn't have enough space for home and root on one partition to actually Play with KDE, I wiped it and started again.
This time I deliberately did not change the point sizes even though it was hard to read. I then copied over some configuration directories from my other installation to this One, none of them related to anything KDE wise or any fonts directory. When I rebooted that installation The problem occurred for the second Time.
As with the wallpaper issue, I immediately converted that energy of irritation to something positive. I troubleshooted the font problem for a short while and when I couldn't isolate it I did a simple thing. I created a couple of other accounts on the same KDE installation to see if I could repeat the error.
That reproduction step is vital before a bug report is created. The other accounts were also residing on my other xFace MX Linux installations, which means I could simply copy them over to the other home partition where KDE was looking at.
In the other accounts I could not repeat the error.
That means a bug report is worthless because repeatability is crucial. Since the usage of a terminal in the K Desktop Environment is important, I changed my strategy and simply installed the xFace Four terminal in KDE. In the end that was a nice move since I know all the keyboard shortcuts of the terminal by hand they are in muscle memory and they have been there for years.
As a bonus I also installed other good shells in MX KDE the hashtags tell you which.
Right now I have a KDE installation in which I can actually work based upon the MX Linux KDE variant
I shall link a couple of photographs in a few minutes
In XFce4 my desktops all have different backgrounds per IPS Led Panel. Its a matter if context menu key (on my keyboard I have one) select background and move the program to the next display beside it and repeat, then move it to the next desktop, display besides AD Infinitum
KDE says HELL NO to that ease. I did some reasearch and saw that it was easy peasy in KDE 4.5.x then got replaced with activities in KDE Plasma 5.x The simple command is now either kwin scripts or a lot of keystrokes and time.
Instead of getting pissed I went further and found that what the programmers replaced with activities (which are POWERFULL and versatile) and also usuable for wallpapers per VTop (Virtual desktop) was eased back (in 2022) with VallPaper
Plasma5 different wallpaper (slideshow, color) for each desktop(or use as desktop widget: Vrame)- - -Installation/Usage- - -- Download the zip file- Unpack the zip file- In the unpacked folder run...
Of all the gripes most frequently expressed about KDE 5, is that USERS were no longer to have separate Virtual Desktops each with its own Wallpaper and its own set of Widgets. In KDE 4.
