×
Power

Aptera Promises The World's First Mass-Produced Solar Car This Year (stamfordadvocate.com) 163

California-based Aptera Motors "is rolling out the first mass-produced solar car this year," reports the Washington Post, after successfully crowdfunding a restart of their development effort: It's a three-wheel, ultra-aerodynamic electric vehicle covered in 34 square feet of solar cells. The car is so efficient that, on a clear day, those cells alone could provide enough energy to drive about 40 miles — more than twice the distance of the average American's commute.

The Aptera must undergo safety tests before the company can begin distribution, which it hopes to do by the end of this year. Even then, it's not clear that consumers will want to buy something that looks like a cross between the Batmobile and a beetle. The shadow of an initial attempt, which ended in bankruptcy, hangs over the founders as they gear up to launch their new product. But the Aptera's creators, Chris Anthony and Steve Fambro, think the world needs a car like theirs. Transportation is the largest source of planet-warming pollution in the United States. The Biden administration has made it a priority to reduce vehicle emissions, and several major automakers have pledged to phase out cars and light trucks with internal combustion engines.

After years of dreaming, maybe the time for driving on sunshine is finally here.

The Post also reports that 7,500 people have already put down a deposit for the two-seater car (which retails for $25,900). It can be charged just by plugging it into an electric outlet, the Post notes, while its creators claim that their car is four times more efficient than the average electric vehicle. "At least 90% of the power produced by the Aptera's solar panels goes toward making the vehicle move, the company says."

"Its extreme efficiency means the car can go 150 miles after just 15 minutes at an ordinary charging station."
Programming

Node.js/Deno Creator Discusses Rust, C++, TypeScript, and Vim (evrone.com) 87

Ryan Dahl, creator of Node.js and Deno, gave a new interview this week to the IT outsourcing company Evrone: Evrone: You have hands-on experience with lots of programming languages: C, Rust, Ruby, JavaScript, TypeScript. Which one do you enjoy the most to work with?

Ryan: I have the most fun writing Rust these days. It has a steep learning curve and is not appropriate for many problems; but for the stuff I'm working on now it's perfect. It's a much better C++. I'm convinced that I will never start a new C++ project. Rust is beautiful in its ability to express low-level machinery with such simplicity.

JavaScript has never been my favorite language — it's just the most common language — and for that reason it is a useful way to express many ideas. I don't consider TypeScript a separate language; its beauty is that it's just marked up JavaScript. TypeScript allows one to build larger, more robust systems in JavaScript, and I'd say it's my go-to language for small everyday tasks.

With Deno we are trying to remove a lot of the complexity inherent in transpiling TypeScript code down to JavaScript with the hope this will enable more people to utilize it.

Evrone: Gradual typing was successfully added into core Python, PHP, and Ruby. What, in your opinion, is the main showstopper for adding types into JavaScript?

Ryan: Types were added to JavaScript (with TypeScript) far more successfully than has been accomplished in Python, PHP, or Ruby. TypeScript is JavaScript with types. The better question is: what is blocking the JavaScript standardization organization (TC39) from adopting TypeScript? Standardization, by design, moves slowly and carefully. They are first looking into proposing Types-As-Comments, which would allow the JavaScript runtimes to execute TypeScript syntax by ignoring the types. I think eventually TypeScript (or something like it) will be proposed as part of the JavaScript standard, but that will take time.

Evrone: As a respectable VIM user, what do you think of modern programmer editors like Visual Studio Code? Are they good enough for the old guard?

Ryan: Everyone I work with uses vscode and they love it. Probably most people should use that.

I continue to use VIM for two reasons. 1) I'm just very familiar and fast with it, I like being able to work over ssh and tmux and I enjoy the serenity of a full screen terminal. 2) It's important for software infrastructure to be text-based and accessible with simple tools. In the Java world they made the mistake of tying the IDEs too much into the worldflows of the language, creating a situation where practically one was forced to use an IDE to program Java. By using simple tooling myself, I ensure that the software I develop does not become unnecessarily reliant on IDEs. If you use grep instead of jump-to-definition too much indirection becomes intolerable. For what I do, I think this results in better software.

Programming

C Passed Java to Take #1 Spot on TIOBE's Index (techrepublic.com) 102

In its ongoing attempt to gauge the popularity of programming languages, "C is at the top of the list of TIOBE'S Index for February 2021 with Java in second place," reports TechRepublic: Those two languages swapped positions on the list as compared to 2020, but the rest of the list is almost exactly the same as a year ago. Python is in the No. 3 spot followed by C++, C#, Visual Basic, JavaScript, PHP, and SQL.

Assembly Language rounds out the top 10 list, up from spot 12 in 2020. R moved up two spots over the last year from 13 to 11. Groovy jumped to the 12h spot, up from 26 a year ago. Classic Visual Basic is on the rise also moving up four spots to 18.

For what it's worth, in the last year Go has dropped to #13 on the list — overtaken by assembly language, R, and Groovy.

And Swift dropped from #10 to #15, also being overtaken in the last year by Ruby.
Bitcoin

Miami City Council Agrees to At Least Study Mayor's Bitcoin Proposal (bloombergquint.com) 25

Miami's mayor Francis Suarez is trying to attract tech talent to his city. (The New York Times recently noted he's joined by "a few venture capital influencers trying to tweet the city's startup world into existence.") So he's still pushing a proposal to use bitcoin in a few city operations as "part of a larger play if you will to position Miami as one of the most tech-forward cities in the country," according to Reuters.

Bloomberg reports: The mayor wants to allow the City of Miami's workers to choose to receive all or a portion of their pay in Bitcoin, according to a resolution passed by the city's governing commission. In addition, the mayor proposed allowing people to pay all or part of property taxes or city fees in crypto.

Although the commission approved the resolution 4-1, it significantly dialed back its original wording. It only agreed to study the practicality of such steps, rather than taking action, as the original proposal had suggested...

Suarez also wants the city to analyze the feasibility to invest some government funds in Bitcoin, the resolution said. It's not clear how much of that is actually possible: Florida statutes have strict limitations on how local governments can invest surplus funds, generally restricting investments to low-volatility instruments such as those issued by the U.S. government. In the past year alone, Bitcoin has shown it can double in price — or lose half its value — in a month's time....

Ken Russell, vice-chairman of the city commission, said he's "certainly not opposed" to the idea of integrating Bitcoin into the city's business, but it's important to ensure "we all know what we're getting into."

"What needs to be done is diligence, and not just from the legal perspective," he said in an interview Wednesday. "It's not just a currency, it's a concept."

Bloomberg also points out that the mayor of the City of Miami "doesn't control the budget or municipal workforce or get a vote on the commission.

"He asked voters to give him more managerial power, but the initiative failed."
The Internet

FreeBSD and Its Code of Conduct Anniversary (slashdot.org) 91

Tokolosh writes: On February 13, 2018 the FreeBSD Foundation posted its Code of Conduct. This included a system for reporting offenders, plus a Code of Conduct Committee to review charges and issue sanctions. The resulting story on Slashdot on February 17 triggered 859 comments. Needless to say, it was controversial.

In 2020, a survey indicated that some 35% of the FreeBSD developer community was dissatisfied with their 2018 Code of Conduct, 34% were neutral, and only 30% satisfied. So they set out to adopt a new CoC. A second survey asked which code of conduct should FreeBSD adopt? 4% favored keeping the 2018 code of conduct, 33% favored the Go-derived code of conduct, 63% favored the LLVM-derived code of conduct. The LLVM Project code was thus adopted.

My pragmatic question back in 2018 was, will this CoC lead to a better FreeBSD, more engagement, a larger, more productive community, and more market share for FreeBSD? In other words, does the CoC give FreeBSD an evolutionary advantage? If a different or no CoC had been imposed, would the FreeBSD of today be different? If so, in what way? The answer is not clear, so I am submitting this story to gather input.

AMD

AMD Is Currently Hiring More Linux Engineers (phoronix.com) 24

According to Phoronix, AMD currently has several interesting job openings on the Linux front. From the report: While AMD has been delivering reliable Linux support with their recent launches, there is room for improvement in areas like more timely compiler support for new processors, better alignment of their new hardware enablement for getting the code not only upstreamed but into distributions for launch-day, and similar areas. Based on recent job postings, it looks like AMD is working to make such strides.

Here is a look at some of the new and currently active Linux-related job openings at AMD: [Manager Linux Kernel Development, Linux Technical Lead, Linux Engineer, and Linux Systems Architect, among other traditional software/hardware engineering roles].

Several of these new job descriptions do begin with, "step up into a new organization built to engage more strategically and deeply with the technical teams of our commercial customers." Interestingly, I only see that opening line on their current Linux job postings. When asking AMD if there is a "new (Linux) organization" at AMD, the comment was there is no organization to announce but this is part of the overall expansion at AMD. So for now it's back to dreaming about a new unit akin to the defunct AMD Operating System Research Center that previously drove their Linux support or Intel's former Open-Source Technology Center.

Security

Microsoft Defender ATP is Detecting Yesterday's Chrome Update as a Backdoor (zdnet.com) 56

Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft's top enterprise security solution, is currently having a bad day and labeling yesterday's Google Chrome browser update as a backdoor trojan. From a report: The detections are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google released last night. As per the screenshot (embedded in the linked story), but also based on reports shared on Twitter by other dismayed system administrators, Defender ATP is currently detecting multiple files part of the Chrome v88.0.4324.146 update package as containing a generic backdoor trojan named "PHP/Funvalget.A." The alerts have caused quite a stir in enterprise environments in light of recent multiple software supply chain attacks that have hit companies across the world over the past few months. System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a "false possitive" and not an actual threat.
Emulation (Games)

Hacker Group Inserted Malware In NoxPlayer Android Emulator (zdnet.com) 2

A mysterious hacking group has compromised the server infrastructure of a popular Android emulator and has delivered malware to a handful of victims across Asia in a highly-targeted supply chain attack. ZDNet reports: The attack was discovered by Slovak security firm ESET on January 25, last week, and targeted BigNox, a company that makes NoxPlayer, a software client for emulating Android apps on Windows or macOS desktops. ESET says that based on evidence its researchers gathered, a threat actor compromised one of the company's official API (api.bignox.com) and file-hosting servers (res06.bignox.com).

Using this access, hackers tampered with the download URL of NoxPlayer updates in the API server to deliver malware to NoxPlayer users. Despite evidence implying that attackers had access to BigNox servers since at least September 2020, ESET said the threat actor didn't target all of the company's users but instead focused on specific machines, suggesting this was a highly-targeted attack looking to infect only a certain class of users. Until today, and based on its own telemetry, ESET said it spotted malware-laced NoxPlayer updates being delivered to only five victims, located in Taiwan, Hong Kong, and Sri Lanka.
"We discard the possibility that this operation is the product of some financially motivated group," an ESET spokesperson told ZDNet today via email. "We are still investigating, but we have found tangible correlations to a group we internally call Stellera, which we will be reporting about in the near future."
Science

The Highest Resolution Photos Ever Taken of Snowflakes (smithsonianmag.com) 51

Photographer and scientist Nathan Myhrvold has developed a camera that captures snowflakes at a microscopic level never seen before. Smithsonian Magazine reports: Myhrvold, who holds a PhD in theoretical mathematics and physics from Princeton University and served as the Chief Technology Officer at Microsoft for 14 years, leaned on his background as a scientist to create the camera. He also tapped into his experience as a photographer, most notably as the founder of Modernist Cuisine, a food innovation lab known for its high-resolution photographs of various food stuffs published into a five-volume book of photography of the same name that focuses on the art and science of cooking. Myhrvold first got the idea to photograph snowflakes 15 years ago after meeting Kenneth Libbrecht, a California Institute of Technology professor who happened to be studying the physics of snowflakes.

In simple terms, the system Myhrvold developed is comprised of one part microscope and one part camera, but with a number of parts that work in tandem to complete the arduous task of capturing an image of a snowflake, a subject that's not only miniscule (most snowflakes measure less than a half-inch in diameter) but also quick to melt. In fact, a snowflake's tendency to disintegrate was one of the biggest challenges Myhrvold had to overcome with this project. His solution: equipping his 50-pound camera system with a thermoelectric cooling system, a carbon fiber frame and LED lights, which give off less heat than standard lights. Every single part of his Frankenstein-esque device, which stands at about five feet in height off the ground when placed on a table, was built using materials that are less likely to cause melting or sublimation of the subject matter.

Myhrvold also had to figure out how to physically capture a snowflake. (It's not quite as simple as hoping that the perfect snowflake just so happens to fall into your mittened hand.) He quickly learned that catching them on a glass microscope slide wouldn't work; glass is a known insulator. But an artificial sapphire slide, made of the same crystal material as one would find in a high-end watch, had a lower thermal conductivity ratio than glass, making it the perfect material to gather specimens. [...] Once safely on the slide, he focuses his microscope to take the photograph, changing the exposure one micron at a time. (For reference, the width of a human hair measures approximately 70 microns.) On average, Myhrvold photographs each snowflake more than 100 times, or as many times as he can before the snowflake starts to melt. Using specialized computer software, Myhrvold combines multiple photographs of a single specimen to create the final photograph. "That photo [is usually the result of] 100 photographs put together using computer software," he says. "You have to take many photos in order to get a high enough resolution, because many photos put together allows you to have enough depth of field to see an entire snowflake very sharply."

Businesses

One-Third of Tech Workers Admit To Working Only 3 To 4 Hours a Day, Report Finds (fastcompany.com) 180

According to a survey by Blind, 31% of professionals from 42 tech companies said they're only putting in between three and four hours a day. Fast Company reports: Additionally, the survey found, 27% of tech professionals said they work five to six hours a day, and 11% reported only working one to two hours per day. In contrast, 30% said they work between seven and 10 hours per day. The survey did not ask the workers to self-report productivity, which we know is very different for everyone.

Although the responses within the companies surveyed were anecdotal, one Amazon employee commented, "Amazon requires at least 10 hours a day, with exceptions and maybe less work on Fridays or more work on weekends. I'm working way more during COVID-19, calendar's full back to back, leadership is asking for more." Meanwhile, a professional at Facebook reported, "If meetings count then 9-10. If they do not... [less than] 1," bearing out the fact that the pandemic has not impacted everyone equally.

United States

More Companies Are Joining 'Tech Exodus' From California (nbcnews.com) 258

This week Digital Reality data center services announced it was also relocating its headquarters from the San Francisco Bay Area to Texas, citing factors like a low cost of living and "supportive business climate". (Though it will still maintain a "significant" presence in the Bay Area.)

And Align Technology (makers of the Invisalign orthodontic dental aligners) also announced it had relocated its global corporate headquarters from San Jose, California to Tempe, Arizona, citing a "favorable corporate operating environment, low cost of living and overall quality of life."

NBC News writes that "while Silicon Valley is by no means ceasing to be the center of the technology industry," there's still an "undeniable migration" that's happening: Shervin Pishevar, a venture capitalist, bought a house in Miami Beach in 2018. In late 2020, Jonathan Oringer, who founded Shutterstock and became an investor, moved to Miami, as did other notable venture capitalists, including Keith Rabois and David Blumberg. It's not just Miami experiencing this migration. Last month, Oracle, the tech giant, announced it is moving its corporate headquarters from Redwood City, California, to Austin, Texas. Other such moves include Palantir, which decamped for Denver, while Elon Musk said last month he had moved himself to Austin. Hewlett Packard Enterprise also announced last month it was moving its headquarters from San Jose, California, in favor of a Houston suburb...

It's significant enough that while the San Francisco Bay Area continues to gain tech workers, the rate of increase is down by over 35 percent — the single largest drop of any tracked metropolitan area — according to self-reported data tracked by LinkedIn. Experts following this migration predict these numbers may grow. "There's a mini-exodus of tech companies leaving the Valley, and I think that's going to accelerate in 2021," said Dan Ives, a financial analyst with Wedbush Securities. But the reasons many businesses are moving are more complex than people may think. Tax experts say companies aren't moving their corporate headquarters necessarily for business tax incentives. Instead, it may be a long-term play to help them pay workers relatively less where the cost of living is lower... "You're going to always have the vast majority of tech companies coming out of the Valley, and you can't create that anywhere else," Ives said. "But when you look at an Austin: It's creating a mini Silicon Valley at half the cost for an average employee..."

Tax experts suspect Oracle and its peers may over time phase out higher-paid employees in California in favor of lower-paid employees in Texas. These companies can also ease off giving employees raises because they are living somewhere with a lower cost of living. "Even though a lot of companies are saying they can let people work from anywhere, most are saying we're not going to cut salary, but we're going to slow the rate of increase of salary," said Brian Kropp, an analyst with the IT service management company Gartner. Kropp said he spoke with high-level representatives from several "Fortune 200 type companies" who are exploring moving their corporate headquarters. In short, shifting employees from California to Texas could represent long-term corporate cost savings, which means larger payouts for these companies' top executives.

"The compounding effect translates to a 3 or 5 percent margin that moves straight to profit," Kropp said...

Kropp says some companies are also worried about the increase in state laws targeting businesses and executives. But there could be another culprit, argues Darien Shanske, a law professor at the University of California, Davis who NBC identiies as an expert on state and local taxation.

"California has blown it, but not because of tax policy — its decades-long problem of not producing enough housing," he said. "It's probably cheaper and easier to build that in Austin."
Cellphones

LG Considers Exiting Smartphones In 2021 (theverge.com) 49

After losing around $4.5 billion over the past five years, LG is considering exiting the smartphone market in 2021. The Verge reports: The Korea Herald reports that [LG CEO Kwon Bong-seok] sent out an internal memo to staff on Wednesday, hinting at a change in direction for LG's phone business. "Since the competition in the global market for mobile devices is getting fiercer, it is about time for LG to make a cold judgment and the best choice," says an LG official in a statement to The Korea Herald. "The company is considering all possible measures, including sale, withdrawal and downsizing of the smartphone business." LG confirmed the internal memo was genuine in a statement to The Verge, noting that nothing has been decided yet. "LG Electronics management is committed to making whatever decision is necessary to resolve its mobile business challenges in 2021," says an LG spokesperson. "As of today, nothing has been finalized."
United States

Is There a Tech Worker 'Exodus' From the San Francisco Bay Area? (sfgate.com) 158

The New York Times reports on an "exodus" of tech workers from the San Francisco Bay Area, where "Rent was astronomical. Taxes were high. Your neighbors didn't like you" — and your commute could be over an hour. The biggest tech companies aren't going anywhere, and tech stocks are still soaring... But the migration from the Bay Area appears real. Residential rents in San Francisco are down 27% from a year ago, and the office vacancy rate has spiked to 16.7%, a number not seen in a decade. Though prices had dropped only slightly, Zillow reported more homes for sale in San Francisco than a year ago. For more than a month last year, 90% of the searches involving San Francisco on moveBuddha were for people moving out...

There are 33,000 members in the Facebook group Leaving California and 51,000 in its sister group, Life After California. People post pictures of moving trucks and links to Zillow listings in new cities.

They've apparently scattered across the country — even to tropical islands like Puerto Rico and Costa Rica They fled to more affordable places like Georgia. They fled to states without income taxes like Texas and Florida... The No. 1 pick for people leaving San Francisco is Austin, Texas, with other winners including Seattle, New York and Chicago, according to moveBuddha, a site that compiles data on moving. Some cities have set up recruiting programs to lure them to new homes.
The Times also notes "there is a very vocal Miami faction, led by a few venture capital influencers, trying to tweet the city's startup world into existence," as other cities begin to realize that "the talent and money of newly remote tech workers are up for grabs." Topeka, Kansas, started Choose Topeka, which will reimburse new workers $10,000 for the first year of rent or $15,000 if they buy a home. Tulsa, Oklahoma, will pay you $10,000 to move there. The nation of Estonia has a new residency program just for digital nomads. A program in Savannah, Georgia, will reimburse remote workers $2,000 for the move there, and the city has created various social activities to introduce the newcomers to one another and to locals...
But the article also points out that "More money was made faster in the Bay Area by fewer people than at any other time in American history," and speculates on what long-time residents may be thinking: People who distrusted the young newcomers from the start will say this change is a good thing. Hasn't this steep growth in wealth and population in a tiny geography always seemed unsustainable? These tech workers came like a whirlwind. Virtually every community from San Jose in the south to Marin County in the north has fought the rise of new housing for the arrivals of the last decade. Maybe spreading the tech talent around America is smart.

Locals have also seen this play before. Moving trucks come to take a generation of tech ambition away, and a few years later moving trucks return with new dreamers and new ambitions.

UPDATE (7/18/2021): "Tech workers who swore off the Bay Area are coming back," the New York Times reported six months later.
Space

Darkened SpaceX Satellites Can Still Disrupt Astronomy, New Research Suggests (gizmodo.com) 64

"SpaceX's attempt to reduce the reflectivity of Starlink satellites is working, but not to the degree required by astronomers," reports Gizmodo: Starlink satellites with an anti-reflective coating are half as bright as the standard version, according to research published in The Astrophysical Journal. It's an improvement, but still not good enough, according to the team, led by astronomer Takashi Horiuchi from the National Astronomical Observatory in Japan. These "DarkSats," as they're called, also continue to cause problems at other wavelengths of light [and] were included in a batch of satellites launched by SpaceX on January 7, 2020. The new study aimed to evaluate the effectiveness of that dark coating...

The scientists found that the "albedo of DarkSat is about a half of that of STARLINK-1113," as they wrote in their paper. That's a decent improvement in the visual spectrum, but still not great. What's more, problems persist at other wavelengths. "The darkening paint on DarkSat certainly halves reflection of sunlight compared to the ordinary Starlink satellites, but [the constellation's] negative impact on astronomical observations still remains," Horiuchi told Physics World. He said the mitigating effect is "good in the UV/optical region" of the spectrum, but "the black coating raises the surface temperature of DarkSat and affects intermediate infrared observations."

A third version of Starlink is supposed to be even dimmer. Called "VisorSats," they feature a sun visor that will "dim the satellites once they reach their operational altitude," according to Sky and Telescope. SpaceX launched some VisorSats last year, but the degree to which their albedo is lessened compared to the original version is still not known, or if these versions will exhibit elevated surface temperatures.

Horiuchi told Physics World that SpaceX should seriously consider lifting the altitude of the Starlink constellation to further reduce the brightness of these objects.

. The article ends with a quote from an astronomer at Harvard-Smithsonian Center for Astrophysics and an expert on satellites. He'd told Gizmodo's reporter back in January of 2020 that "SpaceX is making a good-faith effort to fix the problem," and that he believes the company "can get the satellites fainter than what the naked eye can see."
Programming

Estimated Cost of Poor Software Quality in the U.S. in 2020: $2.1 Trillion (techrepublic.com) 118

TechRepublic shares a remarkable calculation by the not-for-profit IT leadership group the Consortium for Information and Software Security: CISQ's 2020 report, The Cost of Poor Software Quality in the U.S., looked at the financial impact of software projects that went awry or otherwise ended up leaving companies with a larger bill by creating additional headaches for them. According to the consortium, unsuccessful IT projects alone cost U.S. companies $260 billion in 2020, while software problems in legacy systems cost businesses $520 billion and software failures in operational systems left a dent of $1.56 trillion in corporate coffers.

As a result, the total cost of poor software quality in the U.S. amounted to approximately $2.08 trillion in 2020, CISQ said. Comparing this to the total U.S. IT and software wage base of $1.4 trillion, the company said the figures "underscored the magnitude of the negative economic impact of poor software quality."

Social Networks

Thousands of Users Unknowingly Joined Signal Because of a 12-Year-Old's App (vice.com) 41

"At least 10,000 Signal users can be attributed to a 12-year-old kid in India who created a somewhat popular clone of the encrypted chat app," reports Motherboard: Dev Sharma, a Signal user from Melbourne, Australia, found the Signal clone when he encountered an unusual thing: Signal displayed a pop-up showing that their friend had just joined the app. Sharma messaged their friend, but the friend had never even heard of Signal, despite apparently using the app. The friend had downloaded a different app called "Calls Chat," according to a tweet from Dev. It turned out, Calls Chat is actually a clone of Signal and lets users communicate with people on the legitimate Signal app.

The app may have been harmless in this instance, but its existence and thousands of downloads shows how it can be relatively easy for someone to take the open source code of Signal and repurpose it for their own means, potentially misleading users about what they're actually downloading in the process. "I didn't know I was creating a clone of Signal, in fact I didn't even know such an app existed," Dheeraj, the boy who made the clone, told Motherboard in a phone call...

The Google Play Store bars developers from impersonating other apps or making others that are deceptive, however. Google told Motherboard on Wednesday that the chat app is no longer available on the Play Store.

Debian

Debian Discusses Vendoring -- Again (lwn.net) 48

Jake Edge, writing at LWN: The problems with "vendoring" in packages -- bundling dependencies rather than getting them from other packages -- seems to crop up frequently these days. We looked at Debian's concerns about packaging Kubernetes and its myriad of Go dependencies back in October. A more recent discussion in that distribution's community looks at another famously dependency-heavy ecosystem: JavaScript libraries from the npm repository. Even C-based ecosystems are not immune to the problem, as we saw with iproute2 and libbpf back in November; the discussion of vendoring seems likely to recur over the coming years. Many application projects, particularly those written in languages like JavaScript, PHP, and Go, tend to have a rather large pile of dependencies. These projects typically simply download specific versions of the needed dependencies at build time. This works well for fast-moving projects using collections of fast-moving libraries and frameworks, but it works rather less well for traditional Linux distributions. So distribution projects have been trying to figure out how best to incorporate these types of applications.

This time around, Raphael Hertzog raised the issue with regard to the Greenbone Security Assistant (gsa), which provides a web front-end to the OpenVAS vulnerability scanner (which is now known as Greenbone Vulnerability Management or gvm). "the version currently in Debian no longer works with the latest gvm so we have to update it to the latest upstream release... but the latest upstream release has significant changes, in particular it now relies on yarn or npm from the node ecosystem to download all the node modules that it needs (and there are many of them, and there's no way that we will package them individually). The Debian policy forbids download during the build so we can't run the upstream build system as is."

Hertzog suggested three possible solutions: collecting all of the dependencies into the Debian source package (though there would be problems creating the copyright file), moving the package to the contrib repository and adding a post-install step to download the dependencies, or removing gsa from Debian entirely. He is working on updating gsa as part of his work on Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downloading during builds that Debian has, so the Kali gsa package can simply use the upstream build process. He would prefer to keep gsa in Debian, "but there's only so much busy-work that I'm willing to do to achieve this goal". He wondered if it made more sense for Debian to consider relaxing its requirements. But Jonas Smedegaard offered another possible approach: analyzing what packages are needed by gsa and then either using existing Debian packages for those dependencies or creating new ones for those that are not available. Hertzog was convinced that wouldn't be done, but Smedegaard said that the JavaScript team is already working on that process for multiple projects.

Operating Systems

Linux Kernel Developers Discuss Dropping a Bunch of Old CPUs (phoronix.com) 93

Charlotte Web writes: With Linux 5.10 having shipped as the latest Long Term Support (LTS) release to be maintained for at least the next five years, a discussion has begun over dropping a number of old and obsolete CPU platform support currently found within the mainline kernel. For many of the architectures being considered for removal they haven't seen any new commits in years but as is the case once proposals are made for them to be removed there are often passionate users wanting the support to be kept.
Open Source

Linux Mint 20.1 Long-term Support Release Is Out (ghacks.net) 21

Thelasko quotes gHacks: Linux Mint 20.1 is now available.

The first stable release of Linux Mint in 2021 is available in the three flavors Cinnamon, MATE and Xfce. The new version of the Linux distribution is based on Ubuntu 20.04 LTS and Linux kernel 5.4...

- Linux Mint 20.1 comes with a unified file system that sees certain directories being merged with their counterparts in /usr, e.g. /bin merged with /usr/bin, /lib merged with /usr/lib for compatibility purposes...

- The developers have added an option to turn websites into desktop applications in the new version [using the new Web App manager]... Web apps behave like desktop programs for the most part; they start in their own window and use a custom icon, and you find them in the Alt-Tab interface when you use it. Web apps can be pinned and they are found in the application menu after they have been created.

Slashdot Top Deals