AI is exposing Linux protection holes quicker than builders can patch them. Fragnesia is the contemporary. Right here's what we recognise about it.

Steven-vaughan-nichols

Consistent with Linus's law, "given enough eyeballs, all bugs are shallow," is essential to open source. 

Unfortunately, the way to AI malicious program-finding tools, including Claude Mythos and OpenAI Daybreak, in the back of most of these eyeballs are AI engines, and they may be proving to be an awful lot quicker at finding security problems than human ones. 

So it is the contemporary critical Linux kernel vulnerability, fragnesia, that has emerged. It's the 1/3 extreme neighborhood root flaw inside the ultimate weeks.

Fragnesia yields root on all important distributions

Following in the footsteps of reproduction fail and dirty frag, this page-cache corruption bug offers unprivileged users a dependable course to full root control on affected structures. And what are the ones structures, you ask? In line with AlmaLinux, Fragnesia without delay yields root on all foremost distributions. So, essentially, all Linux distros can be targeted and effectively hacked. Are we having fun yet or what?

The Trojan horse was changed into a disclosed this week by means of the ai protection employer Zellic, with William Bowling and other researchers using the enterprise's AI-agentic software auditing tool, v12. It works by using abusing a good judgment malicious program in the Linux XFRM (brief for "transform") esp-in-tcp subsystem to write arbitrary bytes into the kernel page cache of study-handiest documents, with out requiring any race condition. 

This opens the door to local privilege escalation and potential container escapes in multi-tenant environments.

Unlike conventional race-circumstance exploits, those vulnerabilities allow attackers to exactly corrupt file-subsidized pages without timing hints, making assaults more reliable and easier to weaponize once proof-of-concept code is to be had.

An evidence-of-idea makes the most exists

Speaking of which, there already exists a proof-of-concept make the most. It builds a 256-access research table that maps all viable keystream bytes to their corresponding nonces. The attack then copies a malicious payload, which overwrites the primary 192 bytes of the transfer consumer command inside the page cache with a small elf stub that calls setresuid and calls a shell. 

In different phrases, for the ones of you who aren't linux experts, it will right away drop the attacker into a root shell.

This is horrific, bad information. It method a local consumer could benefit from superuser (root) privileges. Pink hat gives it a commonplace vulnerability scoring gadget (cvss) score of seven.Eight, which makes it an excessive-level security bug.

Just as terrible, at the same time as fragnesia is technically a nearby privilege-escalation computer virus, its effect scales dramatically in modern-day cloud architectures that run large numbers of untrusted bins on shared Linux kernels. 

Here, if an attacker can run code in a box or a confined person account however still create namespaces and network stacks, that individual ought to gain root on the host and, from there, assault different customers' virtual machines (vms) or containers.

The way to mitigate fragnesia

Kernel developers and distribution maintainers at the moment are running to harden the esp-in-tcp code path, with proposed fixes specializing in getting rid of in-vicinity differences on shared, record-sponsored pages and tightening fragment handling. An upstream patch to fix fragnesia is available now. However it's no longer currently shipping in any distro as of can also thirteen.

In the meantime, you may mitigate it by running the following command as root:

# printf 'set up esp4 /bin/falseninstall esp6 /bin/falseninstall rxrpc /bin/falsen' > /and many others/modprobe.D/fragnesia.Conf

But, if you accomplish that, you'll also knock out ipsec, which means that your linux virtual non-public networks (vpns) may not paintings. Satisfied, happy, pleasure, joy.

You could, as a substitute, in step with crimson hat, run the following command as root:

# echo "user.Max_user_namespaces=zero" > /and so on/sysctl.D/dirtyfrag.Conf sysctl --machine

Here, but there's any other trouble: it disables unprivileged user namespaces, which may also have an effect on rootless packing containers, sandboxed browsers, and Flatpak. 

It is always something!

Wait for your distro to deliver a patch

You might be better off just looking forward to your distro to supply a patch. I recognize maximum major distros are already beta-testing the patch, and that i wouldn't be surprised if patched linux kernels are to be had by way of may additionally 14. Come that day, you have to patch your systems asap.

Why is this going on? 

I'll be going into greater detail later, however for now, suffice it to mention that Chris Wright, Red Hat's CTO, and that i spoke about this very issue earlier these days, and it boils all the way down to our ai fault detectors being a whole lot higher than they had been even some weeks ago at locating real bugs. 

We can expect to see many more such protection holes discovered in the following few months.

We're going to want to get a lot quicker at fixing insects as they appear.

This, in this manner, is not only a problem for Linux. It's difficult for all open-source software, and as AI gets better at reverse-engineering binary code, Windows and other proprietary software developers will need to upgrade their repair capabilities as well.

For fans of Apple, good tidings

The Linux operating system has been updated to version 6.2, and while those hoping for significant feature additions may be let down, one modification will likely catch the attention of many users.

Linus Torvalds, the creator of Linux and its chief developer, explained in a brief blog post(opens in new tab) that there had been a few minor fixes prior to the release, adding, "I wasn't going to apply any last-minute patches that weren't aggressively pushed by maintainers."

Nothing stuck out as warranting delaying the release of 6.2, according to Torvalds, so any finishing touches "will have to show up for stable."

We need your assistance to create a better website for our users. By responding to our poll and sharing your thoughts and ideas about the tech sector in 2023, you can contribute. Your responses will all be kept private and secret, and it won't take long. Once more, thank you for your assistance in improving TechRadar Pro.

This may downplay the fact that Asahi Linux's developers' work has enabled Linux-based operating systems to be supported on a variety of Apple's proprietary silicon, including the M1 Pro, M1 Max, and M1 Ultra processors.

Apple's M-series chips have been excellent news for ardent macOS users, bringing notable performance improvements to all aspects of processing and efficiency, but they have created a barrier for other hardware apps.

The mainstream Linux support joins the recently announced availability of Windows 11 on Macs with M1 and M2 processors using Parallels 18.

Although this is encouraging news, it's unclear what it might imply for the future of the Linux roadmap. Although it lacks the massive financial support of Windows and macOS, its committed team of coders is likely to keep pushing for greater compatibility in upcoming releases.

 

It can steal data, use the webcam, or install a crypto miner 

A brand new Linux malware( opens in new tab) strain able of different kinds of nasties has been detected, able of abusing licit pall services to stay hidden in plain sight. 

 

Cybersecurity experimenters from AT&T Alien Labs lately discovered( opens in a new tab) the malware and named it Shikitega. It comes with a super bitsy dropper( 376 bytes), using a polymorphic encoder that gradationally drops the cargo. That means that the malware will download and execute one module at a time, making sure it stays retired and patient. 

The command & control( C2) garçon for the malware is hosted on a “ given hosting service ”, making it stealthier, it was said. 

 

Shikitega is relatively potent, as it can run on all kinds of Linux( opens in new tab) bias, and allows trouble actors to control the webcam on the target endpoint( opens in new tab), as well as steal credentials. On the other hand, it’s also able of running XMRig, known crypto jacked that mines the Monero cryptocurrency for the bushwhackers. One can only presume that the XMRig was added to make use of compromised bias that has no sensitive data to be stolen. 

The malware relies on two vulnerabilities, both blasted months agone, to compromise the bias and achieve continuity. One is PwnKit( CVE-2021-4034), one of the further ignominious vulnerabilities that went undetected some 12 times, before eventually being spotted and fixed before this time. The other bone is CVE-2021-3493, discovered and renovated further than a time ago( in April 2021). 

 

While there’s a fix for both these holes, the experimenters are saying, numerous IT directors are yet to apply them, especially when it comes to the Internet of effects( IoT) bias. 

The experimenters don’t yet know who the authors are, and are suggesting all Linux admins to keep their software up to date, install an antivirus( opens in a new tab) and/ or EDR on all endpoints, and make sure they back up their garçon lines. 

Lack of official word doesn’t bode well for the corporate, say developers

Microsoft’s official repository, from which it serves all its cross-platform software for several Linux distros, was knocked offline for nearly a whole day.

Microsoft builds and supports a spread of software products for distros like Red Hat Enterprise Linux, CentOS, Debian, Fedora, Ubuntu, et al., and makes them available via standard APT and YUM package repositories. 

Many users who used these software and tools took to GitHub to boost the difficulty with the respective projects, including .NET Core, Microsoft Teams, Microsoft SQL Server for Linux, Microsoft Edge, et al..

Microsoft engineer, Rahul Bhandari, from the .NET team informed users that the repository “ran into some space issues.” 

The outage apparently disrupted the workflow of the many developers, who were frustrated by the shortage of communication from Microsoft.

In response to Bhandari’s update, which came several hours into the outage, one user listed several other issues raised by users in other projects that were closed with no update or resolution to the disruption.

A status update on the Azure DevOps project by another Microsoft programmer, Edgar Ruiz Silva pinned the difficulty of maintenance work. 

“The issue is now fully mitigated. Maintenance work on packages.microsoft.com caused temporary unavailability of some files therein the package repository. We apologize for the impact this had on our customers,” wrote Silva.

An outage of this type and scale by one among the leading cloud providers doesn't reflect well on Microsoft, especially when its competition goes all bent to demonstrate the prowess of their cloud computing platform.

The least that Microsoft can do now, especially given the quantity of disruption caused by the broken repositories, is to take the time to interact with its users and explain the difficulty intimately, alongside the steps they’ve taken to make sure such disruptions don’t reoccur.

(Image credit: Image Credit: Pixabay)

The newest future Support (LTS) edition of the Linux kernel, set to power some important upcoming Linux distros, has been released as per schedule.

As is that the norm, the last kernel release of the year is an LTS that’s maintained for the subsequent half a decade. LTS kernel releases find yourself in LTS distros that put a greater emphasis on stability and are wont to power servers and important services.

The rate of changes during this release has bothered Linus Torvalds, the principal developer of the Linux kernel, throughout its seven weeks of the development cycle. within the end, however, the massive number of changes within the release candidates only translated into a wealth of latest features for the ultimate release.

• Here are the simplest Linux distros for business
• We’ve also rounded up the simplest Linux distros for developers
• These are the simplest Linux laptops for running Linux

“It's mostly drivers - because it should be - with a smattering of fixes everywhere,” notes Torvalds within the release announcement. 

The release improves support for the subsequent generations of desktop CPUs from Intel called Rocket Lake. Furthermore, there’s also some early support for the 12th generation Alder Lake CPUs also because of the 13th generation Meteor Lake CPUs from Intel.

On the AMD side of things, there are performance improvement fixes for the AMD Zen 3 CPUs. the discharge also improves the support for the RDNA 2 architecture, which can power the next-gen gaming graphics from AMD. 

Kernel 5.10 also adds support for the ARM Video Core IV that’s utilized in the Raspberry Pi 4 and a few initial support for booting RISC-V on EFI systems.

There’s also something for gamers because the release supports the Nintendo Switch Joy-Cons and Pro controllers. you'll use all their features including rumble, and even accelerometer and gyro data in both Bluetooth and wired USB mode.

Source URL

Kaspersky report finds Linux users facing an increase in cyber threats

Latest Update: Linux is now available on more Windows 10 versions

Microsoft expands Windows Subsystem for Linux 2 to Windows 10 1903 and 1909

Linux users will soon be ready to enjoy support from more Windows 10 builds to figure with.

Microsoft has announced it'll be including Windows 10 1903 and 1909 builds in support for Windows Subsystem for Linux 2 (WSL2), allowing the open-source software to run on more versions than ever before.

Previously, WSL2 users had been limited to the newer Windows 10 2004 or higher releases.

• We've highlighted the simplest Linux distros around today
• Best Linux apps: free and open-source software
• Best laptop for programming: top picks for coders, developers, and sysadmins

Windows 10 Linux

"We heard what proportion you liked WSL 2 and wanted to expand its accessibility, and over a previous couple of months, we worked on bringing it back to 1903 and 1909," Microsoft Windows Servicing employees Ty Citrin and Mitchell Minkoff wrote during a blog post announcing the launch.

"We’ve heard great customer feedback on what percentage users have enjoyed using WSL 2, and therefore the primary goal for this backport is to form WSL 2 available to more Windows users."

The pair say that WSL 2 is, "a new version" of the architecture in WSL that changes how Linux distributions interact with Windows. Each Linux distribution can run as WSL 1 or as WSL 2, and maybe switched between at any time.

All the features for WSL 2 distros will now be available for a good larger user base, with the pair promising a full Linux kernel built into WSL 2.

They are also bringing filing system performance now on par with Mac and Linux speeds, improved supervisor call instruction Support for all Linux applications notably, and Docker Desktop support.

The update is merely for x64 systems because it stands, with users on ARM64 versions wanting to upgrade to Windows 10 version 2004 and you’ll gain full access to WSL 2.

The news comes shortly after Microsoft also announced it might be bringing graphics processor support to Linux on Windows 10 through WSL, with Nvidia, Intel, and AMD also announcing their support.




Source URL

Linux Laptop: Linux laptop vendor uses a really surprising hack to guard your privacy

Nail polish on screws may be a good way to guard laptops against tampering while in transit

Several years ago, it had been revealed that the US National Security Agency (NSA) will sometimes intercept networking gear during shipping so as to switch it to supply backdoor access to the hardware. to urge around this, one company has devised an ingenious hack to make sure that its laptops arrive at customers without being tampered with.

Just six months ago, the social purpose company Purism decided to formalize its anti-interdiction services in order that they appeared as a drop-down choice as against being a “hidden menu item” that was difficult to seek out. The laptop and smartphone maker is one among if not the sole hardware vendor that gives an entire suite of custom anti-interdiction measures to stop its devices from being tampered with during shipping.

What exactly are these anti-interdiction measures? Well for starters, Purism applies glitter nail enamel to all or any of the screws on the rock bottom of its Librem 13 and Librem 15 laptops in order that users will know if someone took the device apart after it had been shipped. the corporate also ships its laptops with customized tamper-evident tape on a bag surrounding the device and its box. it'll even send pictures of the laptop measures it performed over encrypted email to customers.

Purism also offers a PureBoot Bundle to detect firmware or OS tampering with a custom pin. this feature includes the company's Librem Key which may be a USB security key to form encryption, key management, and tamper detection convenient and secure. for patrons that want additional security, Purism will even ship the Librem Key and laptop separately to different addresses to form interdiction even harder.

When Purism first formally announced that it might offer anti-interdiction services to its customers, the corporate expected it to be a fringe upgrade that only a little number of individuals would choose. However, many purchasers trying to find additional security decided to upgrade to its anti-interdiction services.

While some people decided to settle on the service because they're during a high threat situation, others just want the peace of mind that comes with knowing their laptop won't be tampered with in transit without their knowledge.

Of the anti-interdiction measures, Purism offers, its glitter nail enamel is extremely popular and customers prefer to have it placed on either the middle screw or all of the screws of their new laptops.

In a blog post, the chief security officer at Purism, Kyle Rankin reflected on the success of the company's anti-interdiction services, saying:

“Six months on I might need to say that the anti-interdiction service has been a hit. we've processed much more orders than I initially thought and for a really diverse range of consumers. Now that the method has become more streamlined we should always be ready to complete future anti-interdiction orders even more quickly and are trying to find other ways we will make it even faster. we've also expanded anti-interdiction services beyond laptops and adapted it to Librem Server, Librem Mini, Librem 5, and Librem 5 USA.”




Source URL

Again, consider Red Hat and Linux. Red Hat could own Linux and it might be left to hoard a comparatively small “pie.” But because Linux may be a truly open community, with contributions coming from a good array of companies and individual developers, it's outpaced Windows, Unix, and each other server OS for many years. This has benefited Red Hat while also benefiting many others.

Indeed, when open source communities are large, and adoption for a specific project grows, it creates a massive opportunity for all. this is often the promise of open source: abundance, not scarcity. It’s also the key to generating customer value, and therefore the revenue that derives from it.




source:

We take a hyperbole-free, zero-snark, and comprehensive look at why you might want to choose each of the big three operating systems. If you're considering a change, read this first.

By mid-2019, most people are fully entrenched with their favorite operating system choice. But, if you're upgrading from an old machine, you might want to re-evaluate your options. If you're choosing an operating system for your desktop or laptop computer, there are three main choices: Windows, MacOS, and Linux.

In this article, we're going to take a comprehensive look at the differences between these platforms for desktop use. Before we get started, let's establish a few ground rules and recognize a few realities.

We're looking at desktop and laptop use only. Choosing a server, IoT, or infrastructure operating system is a very different beast, something we don't have room to discuss in this article.

We are well aware of the nearly religious affinities for each of these platforms. We'll touch lightly on some of the fundamental features that drive these affinities, but we're not preaching. Each choice works for different people. We're not telling you what to do, we're just discussing some factors you might want to keep in mind when making a choice.

We will consider how these well-understood OSs differ in 2019. We've started each OS off with six key considerations, so if you want to just skim, you'll get a good feel for the pros and cons of each system merely by scanning the 18 considerations in our pro and con lists.

And, with that, let's take a deep dive into today's three leading desktop platforms.

Use and cost

Let's start with the key questions I ask when anyone comes to me for advice about computer purchasing:

• What do you want to do with it?
• How much do you want to spend?
• Which of those two (use versus spend) is more important?

Windows typically comes with new PCs. If you have an old PC, it almost certainly came with Windows. Pretty much the only time you're going to pay to buy Windows is if you're building one of your own, and we'll address that later. Macs always come with MacOS, so there's no cost there. And, of course, Linux is free. The much bigger cost for all these environments will be your ongoing maintenance expenses.

Choosing a computer is always about making trade-off decisions. If you've got a very limited budget, then your choice is often going to be Windows or even Linux. If you're going to do heavy graphics or video production, your choice might often be Mac. The point is, before you choose your desktop platform, it's important for you to identify your needs.

I find that the trade-off between use and spend is often the deciding factor. I recently bought a new main desktop machine. In my case, I didn't want to spend all that much, but my bigger priority was getting my job done.

Because of the amount of work I have to do, I'm always finding ways to save time. If my computer choice increases productivity at the expense of cost, well, then I'm probably going to be spending more money. I need those hours back.

You may have a hard-and-fast budget, or you may have a key need. As you work your way through your choices, keep these factors (and the balance between them) in mind.

windows-10-april-2019-update-the-new-fea-5c92610fdd173300c125b5b7-1-mar-25-2019-16-42-08-poster.jpg

Understanding Windows




Let's talk Windows. Windows went through a rough period during its Windows 8 generation. Microsoft removed the Start menu, forcing users to rely on gestures to find features and launch applications. Microsoft also introduced a limited version of Windows called Windows RT, which only allowed Windows Store apps and didn't run on the Intel platform.

Three years later, in 2015, Microsoft introduced Windows 10, a substantially improved version of Windows that returned the Start menu. Microsoft improved the user interface, streamlined many of the settings, and eliminated the odd inconsistencies that had haunted Windows 8. Windows 10, which has had some substantial interim upgrades, is a truly strong Windows release.

By most accounts, Windows runs on roughly 90 percent of PCs worldwide, with desktop Linux usage accounting for a very low single digit percentage of usage and MacOS making up the rest. In developed markets like the US, the Mac percentage is considerably higher, at around 20 percent. But corporate usage, with the exception of some companies like IBM, is almost all Windows. For most people, Windows is the default choice.

WINDOWS MEANS CHOICE

In fact, choice is Windows' outstanding feature. No matter what kind of computer you want, what configuration, or what form-factor, there's a Windows machine for you. Microsoft has long embraced touch-screen computing with Windows, a feature not found in Macs anywhere. Windows machines are built by hundreds of manufacturers, and users have long built their own machines from easily-available components.

That means if you want a Windows computer that's really a tablet with a detachable keyboard, an all-in-one, a super-beefy tower machine with lots of blinking colored lights, or even a system on a USB thumb drive, along with so many more options, there's a Windows machine for you.

When it comes to customization, that choice increases exponentially. If you want to build a machine yourself, you can add nearly any configuration of cards and features you want. Do you want four beefy graphics cards working in tandem? Windows can do it. Do you want on-board instrumentation inputs? Windows can do it. Do you want to be able to run 10 drives internal to the machine? Well, of course, Windows can do it.

There are downsides to all this flexibility, of course. Getting all these independently produced components to work together can be challenging. Finding exactly the right mix of drivers that don't conflict with or break each other can often be a hair-pulling experience.

But if you're building something this custom, you've probably been down this road before. Most Windows users will buy pre-built laptops where all the drivers generally get along with each other and (again, generally) have been pre-tested at the factory before shipping.

VARIABLE QUALITY AND VARIABLE COST

Another big benefit of Windows is cost. While machines from mainstream manufacturers like Dell, Microsoft, and Lenovo have prices comparable to Apple products, it's also possible to buy a Windows laptop for under $200. It'll perform like a dog, but it will run. You can also build a $100,000 PC, if the urge strikes you.

Because of the vast number of Windows suppliers, product quality can be inconsistent. If you purchase a machine built for a business buyer from a top-tier vendor, you're almost sure to get excellent quality, better components, pre-shipment testing, and long-term support -- at a higher purchase price. But if you purchase a less expensive machine from a white box reseller or many of the lower-cost off-branded suppliers, component quality, support, and testing can range from unpredictable to downright unavailable.

As you might imagine, as the platform with the largest market share, Windows also offers the most applications. When you choose a machine, it's about the apps you need to run. This is a much bigger factor than the operating system or even the cost.

In my experience, the applications on Windows range from excellent to some that are, to be kind, are barely workable. This, of course, is not unique to just Windows, but because there are so many developers, you see a wider range of spotty apps along with a wider range of apps for almost any purpose.

To improve on Windows app quality, Microsoft has instituted the Windows Store. Developer participation is optional, so not all apps are distributed through the Store. That said, Microsoft has been diligent in keeping an eye on quality, eliminating apps that are unsafe for users as they find them.

But there's one Windows disadvantage. Because there are so many more Windows users, malware, spyware, and ransomware are far, far more prevalent on Windows than on MacOS or Linux. The vastly larger total number of potential targets provides a considerably larger return on investment for ransomware and similar attacks. Nearly all breaches, including the vast corporate breaches, are initiated through a phishing or malware attack that gains a foothold on an individual's Windows PC and then makes the jump into a corporate network.

ENTERPRISE AND GAMING

For corporate users, Windows-based authentication integrates "out of the box" with Active Directory-based corporate servers. You can accomplish the same thing with Mac and Linux machines, but you'll need to get extra add-on software to do so. With Windows, corporate networking is built in -- at least as long as you're running the Pro versions. Windows Home does not come with corporate connectivity. There will be an additional upgrade fee.

For home users, gaming is huge on Windows-based PCs. While there are never-ending debates over whether consoles have more gaming power than beefy gaming PCs, there's no doubt that gaming PCs offer a level of gaming involvement and customization that nothing can top. Not only can Windows PCs be equipped with incredible power, there's also an entire submarket in providing RGB lighting effects for everything from motherboards to memory sticks. If you're a gamer and you want to get your bling on, nothing beats PC gaming.

Getting to know MacOS




If you could reach back in time 35 years ago and gently pluck an original Macintosh user from 1984 and put her in front of a brand new 2019 Mac, she would be able to operate today's machine. The file system would look the same. The menu bar would look the same. Even the trash would look the same.

Sure, instead of just a few thousand black and white pixels, the screens would be in glorious high-resolution color, and the speed, breadth, and depth of the applications would be mind-boggling, but the fundamental interface would be understandable.

No OS other than MacOS has had that level of continuity. Macs have undergone fundamental processor changes, jumping from 68000-based devices to PowerPCs, migrating to Intel chips, and -- probably in the next few years -- migrating to Apple's own silicon. But to the users, every single change in how the Mac has evolved has had a level of internal consistency and predictability unrivaled by any other platform.

Interestingly, even though some aspects of the system remain effectively unchanged for more than three decades, that doesn't mean that MacOS feels particularly dated, although, as nearly every Mac user will admit, it does have its quirks.

Although Macs have historically suffered far fewer malware threats than Windows machines, there has been a small rise in malware variants targeting MacOS users -- mostly for the contents of cryptocurrency wallets. While it's not as existentially necessary to run an anti-malware program on a Mac, it's generally a good idea. Microsoft has recently starting bringing its Defender software to Macs, but right now, that's limited to enterprise use.

THE MACINTOSH ECOSYSTEM

We can't discuss MacOS without discussing Macintoshes. The two go together. While Windows can run on thousands of different machines from hundreds of different vendors, MacOS is distributed by Apple to run solely on Apple hardware. There is a small, intrepid group of Hackintosh builders who source Macintosh compatible hardware and build their own systems, but they're outliers, and the process of building a Hackintosh takes some work.

A common misconception about Macintosh hardware is that it's more expensive than equivalent PC hardware. In fact, that's not true. If you compare spec-for-spec Mac hardware against the equivalent premiere PC hardware like the Microsoft SurfaceBook or the Lenovo ThinkPad X1 Carbon, you'll find that the pricing is similar. When I compared a highly equipped 2018 Mac mini against available PC parts, I was unable to source a PC with anywhere near the capability and size of the Mac mini.

Where PCs are cheaper is when you're not looking at brand-name or spec-for-spec comparisons. You can absolutely get cheaper laptops and desktops for Windows than Macs. Additionally, if you're willing to sacrifice Mac's legendary design and go for a traditional tower Windows PC, you can generally get more performance for the dollar.

Although the buy-in cost for Apple hardware is often more expensive, many have found that the overall cost of ownership over the lifetime of the system is less expensive with Macs. IBM did a study before the company decided to standardize on Macs, where they found that:

PCs drive twice the amount of support calls. They're also three times more expensive. That's right, depending on the model, IBM is saving anywhere from $273 to $543 per Mac compared to a PC, over a four-year lifespan.

Macs are also appealing because of their design and integration. MacOS is tightly integrated with iOS, to the point that you can even share clipboards between a Mac and an iPhone, or use an iPhone to take a picture that drops directly into a Mac application.

LEGENDARY EASE OF USE

Although some Windows users may dispute this, many Mac users believe that MacOS is easier to install and update, offers faster updates with less hassle, and allows applications to be installed and managed with greater ease than Windows.

Out of the box, MacOS also comes with a deep range of applications for free, including the music composition tool GarageBand, video editing application iMovie, and a complete productivity package consisting of Pages (word processing and layout), Numbers (spreadsheet), and Keynote (presentations). The MacOS Preview app provides a wide range of features, including editing PDFs.

While MacOS is often touted as an easy-to-use operating system, it also greatly appeals to design and development professionals. Under the hood, MacOS has a UNIX foundation, which means that the UNIX command line is a mere terminal window away. MacOS also has AppleScript, which can be used to automate complex workflows.

RUN MAC, WINDOWS, AND LINUX APPS

If you sufficiently equip your Mac (and by this, I mean an i7 processor or better, 16GB of RAM or better, and definitely SSD instead of hard drive), you can use Parallels or another virtualization application to provide multiple operating systems on the Mac. This is a big appeal for me. I use a well-equipped Mac with Parallels, and I'm able to run Windows and Linux side by side with MacOS applications, even dragging and dropping across operating systems. This level of flexibility is unmatched on any other OS.

It's important to note that most Macs can't be upgraded. When you spec out your CPU, memory and storage, that's what you'll have to live with. While the new, 2018 Mac mini does allow RAM upgrades, it is a complex, tedious, and delicate process. Other machines, like the insanely expensive iMac Pro, allow RAM to be upgraded, but it requires a highly skilled technician to remove the permanently glued display and case to get at the machine's innards, voiding the warranty in the process..

Finally, there are some applications that run solely on MacOS, like the high-end video production tool Final Cut Pro X. With a virtualized copy of Windows, a Mac can be used to run any application you might need (including Windows and Linux programs), where if you're running on a Windows machine, MacOS applications are not available.

Keep in mind, though, that you're limited to the hardware produced by Apple. If Apple chooses not to update a form factor or model for a few years (as has happened a lot in recent years), you're out of luck for that hardware unless you decide to build a Hackintosh. But with the advent of the T2 security chip last year, and the expected move to Apple-designed CPU chips, it may not be possible to home-build a Hackintosh for much longer.

Looking at Linux



I have three Raspberry Pis running the OctoPi distribution of Linux controlling my 3D printers. I have a Debian distribution running my home server. Out on the Internet, I have at least 10 CentOS distribution virtual machines running my websites. And in my various home devices, I have an uncountable number of Linux instances running, driving everything from my smart TVs to my Internet router.

Linux is renowned for its versatility, particularly in servers and embedded solutions. But in this article, we're talking about desktop Linux implementations, where you'd use Linux with a keyboard and mouse to, at the very least, check your email.

Unlike either Windows or MacOS, Linux is an open-source operating system, originally developed by Linus Torvalds back in 1991. Because it's open source, it can be modified and extended by anyone; a virtual army of loosely affiliated coders have been working on it for nearly 30 years.

OPEN SOURCE

Also because it's open source, different variants (called distributions) have been released, containing everything from different core functionality to a wide variation of settings and configuration options, to different user interfaces, and even different fundamental purposes. The OctoPi distribution running on my $30 Raspberry Pis was built entirely around managing 3D printers.

One reason many of the Linux faithful flock to the operating system is because it's not controlled by Microsoft or Apple. This can be something of political preference or it can be a practical one: The desire or need to customize an OS at a level not permitted by a corporate overlord.

MANY LINUX DISTROS

For our desktop comparison though, let's focus on the truly practical. What can it do for you today? Well, first, as we've established, there's no "it." This is no one true Linux. You'll need to choose a distro (shorthand for "distribution"). We'll make that easy for you. Our in-house Linux guru, Steven J. Vaughan-Nichols, recommends Linux Mint, calling it "The better-than-ever Linux desktop."

There was a time when the graphical user interface of Linux wasn't up to Windows or MacOS standards. Now, there are many different Linux GUIs, and the ones that come with Mint are every bit the equal of Windows' Explorer interface or the Mac's Finder.

Although Linux is considerably more secure than Windows and even somewhat more secure than MacOS, that doesn't mean Linux is without its security flaws. Linux doesn't have as many malware programs, security flaws, back doors, and exploits, but they are there. But they're a whole lot less than the virtual flood of malware that infects Windows users on a daily basis. Network administrators and developers like this more minimal security footprint, but it's likely that using MacOS would provide a similarly low-risk profile, with a lot more software compatibility.

With a few exceptions, mostly from Dell, you're not going to buy a PC that already runs Linux. The vast majority of users retrofit a former Windows PC with a Linux OS or build a PC from parts and load a Linux distro. This is not hard. Linux installers have also come a long way. My wife, who is technically inclined but had never used Linux, installed Linux Mint on an old laptop in just an hour or so, with no help.

A VERY HANDS-ON OPTION

That said, the usability of Linux isn't just the desktop. Much of the complexity results in trying to get corporate solutions to work in a Linux environment. For example, the webcast software we use requires true PowerPoint files. Even though there are Linux substitute solutions for slide preparations, making it all work on a workflow deadline can often be time-consuming.

There are compatibility solutions like WINE and Crossover, but once again, you're spending time fiddling for compatibility when you might otherwise be getting your job done. Another common approach is to use cloud-based software such as Google Docs or Office 365. Yes, Office 365 will run on Linux via Chrome (although the web version does sacrifice some functionality).

You also have an enormous range of devices that support Linux. For example, if you have an HDMI-equipped TV, an old USB keyboard and USB mouse, you can set up a moderately workable Linux desktop on a Raspberry Pi for less than $80.

Application selection is a bit of an issue for Linux users. Linux runs the Chrome browser (among others), so any web-based app is fully functional on Linux. But if you're a die-hard Microsoft Office or Adobe Creative Cloud user, you might have to find substitute solutions.

That's the key with Linux applications. There are substitute (usually free) solutions for nearly any MacOS or Windows app you might choose to use. They don't always work the same. Some are rougher around the edges, not having had the polishing effects of professional product management. While mostly file-format compatible, they're not identical.

That said, regardless of whether you want office apps, media production apps, or coding tools, there are Linux versions available -- usually without any fee or subscription.

While there has been some push for Linux gaming, the fact is that both MacOS and Linux lag behind Windows when it comes to gaming selection. If you're a hard-core gamer, you'll want to investigate carefully which games are available.

The Chromebook option

Chromebooks are basically the Chrome browser baked into the hardware of a notebook computer. Ranging from a few hundred bucks to over a thousand dollars, Chromebooks come in various power and sleekness levels, depending on your budget.

Chromebooks run on Chrome OS, which is a variant of the open source Chromium OS, which is based on Linux.

In general, when you're running a Chromebook, you're limited to apps that you can access from your browser. For many, that's enough. But for those who need to run native Linux apps, it's possible to run an integrated Linux environment in a VM, right within Chrome OS.

What makes Chromebooks particularly compelling is how easy they are to manage. It's a simple button tap to completely clear and reinstall, which makes Chromebooks a favorite among school IT managers who normally have to face complex installation and update processes and maintenance protocols.

Which OS is right for you?

If you were stuck on a deserted island with good Internet, and all you had was one of the above OSes, you'd be fine. You could generally get anything done that you'd want to get done with Windows, MacOS, or Linux. To some degree, that's why OS choice has become something of a minor "religious" war because instead of tangible differences, the OS choice becomes one of the preferences.

That said, there are some reasons you might want to choose one OS over another. Here are a few if-then decision recommendations that might help.

• If you have an old PC and you want to update it to a fully modern OS for free, go with Linux.
• If you want to be able to choose from any hardware configuration you want with zero restrictions, go with Windows.
• If you want to run MacOS, Windows, and Linux apps all on the same machine, run MacOS.
• If you want super-tight integration between iOS and your desktop OS, with carefully tuned hardware, go with MacOS.
• If you want to get a notebook computer for less than $1,000, get a Windows machine or a Chromebook, or retrofit Linux on an older laptop.
• If you want to play Triple-A PC games, get Windows.
• If you want to brag about how much better your machine is than everyone else's, get a Windows machine… or a Mac… or a Linux machine. There's a lot to brag about with each of these OSs.

What do you think? Which OS do you run and why did you make your choice? Comment below. And, hey, be nice. We all have different opinions. Let's be friendly and keep things practical and not ideological. No one needs more bile these days.



READ MORE:

One operating system for two platforms? It's an old idea, which has never worked out, but the Linux laptop and smartphone company Purism is giving it another try.

There are quite a few people out there who want the same Linux on both their smartphone and their PC. Perhaps the best known of them is Canonical's Mark Shuttleworth. He tried for years to ignite a market for Ubuntu Linux running on tablets, smartphones, and PCs. It didn't work. After years of effort, Canonical gave up on its one operating system for all platforms plans. Dreams don't die. Now, Purism, the open-source laptop and smartphone vendor, is bringing the idea back to life with future releases of its PureOS Linux distribution.

Jeremiah Foster, the PureOS director, announced: "Purism's PureOS is convergent, and has laid the foundation for all future applications to run on both the Librem 5 phone and Librem laptops, from the same PureOS release."

Convergent? Foster explained it means the operating system and its applications will have a "consistent look and feel, as well as the exact same functionality for apps that run on your phone and your computer."

That's easier said than done.

"It turns out that this is really hard to do unless you have complete control of software source code and access to hardware itself. Even then, there is a catch; you need to compile software for both the phone's CPU and the laptop CPU which are usually different architectures. This is a complex process that often reveals assumptions made in software development but it shows that to build a truly convergent device you need to design for convergence from the beginning," Foster said.

Since Purism builds both its own hardware and software, it's in a good position to tackle these inherent problems. Purism started in 2015 as a free-software, crowd-sourced laptop manufacturer. It's hardware is designed to be as free as possible of any proprietary firmware or binary code, popularly known as blobs. PureOS, itself, is a Debian Linux-based operating system. On it, PureOS supports the GNOME and KDE Plasma Mobile interfaces.

Put it all together and Purism has more control of the complete device stack from the chips on up to the interface than any of its competition except for Apple. But, even Apple, which has macOS for its computers and iOS for its tablets and iPhones, doesn't try to run one operating system on both hardware platforms.

With Debian as its foundation, Purism claims PureOS can run on both laptops' power-hungry and fast CPUs and smartphones' power-aware and battery-saving CPUs. It also means, Foster claimed, that "there is a large set of packaged software that 'just works' on many different types of CPUs."

Of course, just because a single application can run on different architectures without re-engineering only gets you so far. For example, an application that looks great on a laptop's 15-inch display won't be so pretty on a smartphone's 5-inch display with its very different aspect ratio.

Purism knows this. To meet the problem, Purism is using "adaptive design." Foster explained, "Purism is hard at work on creating adaptive GNOME apps -- and the community is joining this effort as well -- apps that look great, and work great, both on a phone and on a laptop. Combining the work of the free software ecosystem with Purism's contributions means we can target convergence for all our Librem hardware line: both the 13- and 15-inch laptops and the 5-inch phone."

With PureOS's adaptive code as the window resizes, the column width dynamically changes to preserve a legible line width, until the sidebar and message view don't fit at the same time. At this point the leaflet folds, only the message view is visible, and a back button is added to the header-bar, to allow navigation to the room list.

Developers will also be able to customize their applications for PureOS by using the open-source libhandy. This is a  GTK+ and GNOME mobile and adaptive presentation library. It's packaged in PureOS and Debian. Programmers can also use it in flatpaks, simply by including it in your Builder flatpak manifest.

Will it work? It looks promising. But I've ridden in the one operating system for many platforms rodeo before. It's not an easy ride. That said, there's long been a demand for a mobile Linux-based operating system that's not Android, so there are customers out there. Purism has beaten the odds before. I won't bet that they can't win again.



READ MORE:

Thunderclap vulnerabilities allow the creation of highly dangerous malicious peripherals that can steal data from OS memory.

Windows, Mac, Linux, and FreeBSD systems are all impacted by a new vulnerability that was disclosed this week at the NDSS 2019 security conference.

The vulnerability --named Thunderclap-- affects the way Thunderbolt-based peripherals are allowed to connect and interact with these operating systems, allowing a malicious device to steal data directly from the operating system's memory, including highly sensitive information.

The research team behind this vulnerability says that "all Apple laptops and desktops produced since 2011 are vulnerable, with the exception of the 12-inch MacBook."

Similarly, "many laptops and some desktops, designed to run Windows or Linux produced since 2016 are also affected," as long as they support Thunderbolt interfacing.

WHAT IS THUNDERBOLT?

Thunderbolt is the name of a hardware interface designed by Apple and Intel to allow the connection of external peripherals (keyboards, chargers, video projectors, network cards, etc.) to a computer.

These interfaces became wildly popular because they combined different technologies into one single cable, such as the ability to transmit DC power (for charging purposes), serial data (via PCI Express), and video output (via DisplayPort).

The technology was initially available for Apple devices but was later made available for all hardware vendors, becoming ubiquitous nowadays, especially thanks to the standard's latest version, Thunderbolt 3.

But according to the research team, all Thunderbolt versions are affected by Thunderclap. This means Thunderbolt 1 and 2 (the interface versions that use a Mini DisplayPort [MDP] connector) and Thunderbolt 3 (the one that works via USB-C ports).

WHAT IS THUNDERCLAP?


Thunderclap is a collection of flaws in the way the Thunderbolt hardware interface has been implemented on operating systems.

At the core of this vulnerability, researchers say they are exploiting an OS design issue where the operating system automatically puts faith in any newly connected peripheral, granting it access to all of its memory --a state is known as Direct Memory Access (DMA).

Thunderclap flaws allow attackers to create malicious, but fully-working peripherals that when connected via a Thunderbolt-capable port can perform their normal operations, but also run malicious code in the operating system's background without any restriction from the operating.

This makes the Thunderclap attack highly dangerous, as it can be easily hidden inside any peripheral.

The Thunderclap vulnerabilities are even capable of bypassing an OS security feature known as Input-Output Memory Management Units (IOMMUs) that hardware and OS makers have created in the early 2000s to counter malicious peripherals that abuse their access to the entire OS memory (in what's known as a DMA attack).

The reason why Thunderclap vulnerabilities work against IOMMU is either because operating systems disable this feature by default, or, in cases the feature has been enabled by the user, the OS leaves user data in the same memory space where the malicious peripheral runs its exploit code, making IOMMU useless.

What's being done about it?

Researchers from the University of Cambridge, Rice University, and SRI International discovered the Thunderclap issues back in 2016, and they've been working with hardware and OS versions for three years in complete silence to have them fixed.

However, despite the almost three-year warning, OS makers have been slow to react, with most of the Thunderclap attack variations described in a research paper published today still working. Here's the current state of patches, according to researchers:

Windows - "Microsoft have enabled support for the IOMMU for Thunderbolt devices in Windows 10 version 1803, which shipped in 2018. Earlier hardware upgraded to 1803 requires a firmware update from the vendor. This brings them into line with the baseline for our work, however the more complex vulnerabilities we describe remain relevant."

macOS - "In macOS 10.12.4 and later, Apple addressed the specific network card vulnerability we used to achieve a root shell. However the general scope of our work still applies; in particular that Thunderbolt devices have access to all network traffic and sometimes keystrokes and framebuffer data."

Linux - "Recently, Intel has contributed patches to version 5.0 of the Linux kernel (shortly to be released) that enable the IOMMU for Thunderbolt and prevent the protection-bypass vulnerability that uses the ATS feature of PCI Express."

FreeBSD - "The FreeBSD Project indicated that malicious peripheral devices are not currently within their threat model for security response. However, FreeBSD does not currently support Thunderbolt hotplugging."

As the table below shows, most Thunderclap flaws are still unpatched.

Thunderclap flaws still working
Image: Markettos et al.

In the meantime, users are advised to disable Thunderbolt ports via BIOS/UEFI firmware settings and to avoid plugging in peripherals from untrusted sources.

Technical details about the Thunderclap flaws are available in a research paper entitled "Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals," available for download in PDF format from here and here, with more details here.

The research team also released the "Thunderclap platform" on GitHub, which is a collection of ready-made proof-of-concept code to create malicious Thunderclap peripherals.

Extra details are also available on a dedicated website and in this blog post.

As a closing note, Thunderclap vulnerabilities can also be exploited by compromised PCI Express (PCIe) peripherals, such as plug-in cards or chips soldered to the motherboard, but these attacks require compromising the peripheral's firmware, making the attack much harder to pull off than just plugging in a charger or video projector via a Thunderbolt interface.




READ MORE: