This is an attempt to turn OpenBSD into a Whonix or Tails alternative, although if you really need that level of privacy, use a system from this list and not the present guide. It is easy to spot OpenBSD using network fingerprinting, this can not be defeated, you can not hide the fact you use OpenBSD to network operators. I did this guide as a challenge for fun, but I also know some users have a use for this level of privacy. ↫ Solène Rapenne Written by OpenBSD developer Solène Rapenne, so you’re probably not going to find a guide written by anyone more knowledgeable.

Microsoft recently announced some big changes to the Recall feature in Windows, and now it’s pulled the Release Preview version which contained Recall entirely. It’s likely not a coincidence that Microsoft also quietly pulled the build of the Windows 11 24H2 update that it had been testing in its Release Preview channel for Windows Insiders. It’s not unheard of for Microsoft to stop distributing a beta build of Windows after releasing it, but the Release Preview channel is typically the last stop for a Windows update before a wider release. ↫ Andrew Cunningham at Ars Technica The company doesn’t actually mention why the release was pulled, but the reason is pretty obvious if you connect the dots. I’m at least glad Microsoft is taking the complaints seriously, and while I don’t personally think Recall is a good idea, if a user gives their consent and uses it knowingly and willingly, I don’t see any problems with it.

Apple’s Worldwide Developers Conference keynote has come to a close — and the company had a whole lot to share. We got our first look at the AI features coming to Apple’s devices and some major updates across the company’s operating systems. If you missed out on watching the keynote live, we’ve gathered all the biggest announcements that you can check out below. ↫ Emma Roth at The Verge Most of the stuff Apple announced aren’t particularly interesting – a lot of catch-up stuff that has become emblematic of companies like Google, Apple, and Microsoft when it comes to their operating systems. The one thing that did stand out is Apple’s approach to offloading machine learning requests to the cloud when they are too difficult to handle on device. They’ve developed a new way of doing this, using servers with Apple’s own M chips, which is pretty cool and harkens back the days of the Xserve. In short, these server are using the same kind of techniques to encrypt and secure data on iPhones, but now to encrypt and secure the data coming in for offloaded machine learning requests. The root of trust for Private Cloud Compute is our compute node: custom-built server hardware that brings the power and security of Apple silicon to the data center, with the same hardware security technologies used in iPhone, including the Secure Enclave and Secure Boot. We paired this hardware with a new operating system: a hardened subset of the foundations of iOS and macOS tailored to support Large Language Model (LLM) inference workloads while presenting an extremely narrow attack surface. This allows us to take advantage of iOS security technologies such as Code Signing and sandboxing. ↫ Apple’s security research blog Apple also provided some insight into where its training data is coming from, and it claims it’s only using licensed data and “publicly available data collected by our web-crawler”. The words “licensed” and “publicly available” are doing a lot of heavy lifting here, and I’m not entirely sure what definitions of those terms Apple is using. There are enough people out there who feel every piece of data – whether under copyright, available under an open source license, or whatever – is fair, legal game for ML training, so who knows what Apple is using based on these statements alone. From Apple’s presentations yesterday, as well as any later statements, it’s also not clear when machine learning requests get offloaded in the first place. Apple states they try to run as much as possible on-device, and will offload when needed, but the conditions under which such offloading happens are nebulous and unclear, making it hard for users to know what’s going to happen when they use Apple’s new machine learning features.

I’ve long been waiting for a powerful ARM laptop that can run Linux comfortably, and it seems that with Qualcomm’s new Snapdragon X Elite SoC, that’s finally going to happen. We talked earlier about how for once, Qualcomm is taking Linux support for their new laptop-focused processors very seriously, and that promise and associated effort is paying dividend. Tuxedo, a popular Linux OEM from Germany, has announced it’s working on a laptop with the Snapdragon X Elite chip, and they showed off a working prototype at Computex in Taiwan. We have been working with a first prototype for some time, which will soon be replaced by a second one. The development is still in the alpha stage, as some drivers are still missing, which will hopefully be available with the next two kernel versions. It is quite conceivable that an ARM notebook from TUXEDO will be under your Christmas tree in 2024. However, there are still too many pieces of the hardware, software and delivery capability puzzle missing to even begin to set a release date. TUXEDO for ARM will come, but we don’t yet know exactly when. ↫ Tuxedo’s website Their timeline of more Qualcomm drivers making it into the next two kernel versions lines up with Qualcomm’s own timeline, so it seems we’re mostly just waiting for them to finish their Linux drivers and add them to the kernel. This is quite exciting, and a much better option for Linux users than buying a Windows version of an X Elite or Pro laptop and hoping for the best.

Last night, I ran through the ZFSBootMenu documentation guide for Void and followed it both on a VM and then on an external SATA HDD plugged through a USB case, taking some notes and getting a general idea of the process. The Void installer does not support ZFS out of the box, so the Void Handbook itself recommends the ZFSBootMenu documentation before its own (a manual chroot installation) when it comes to doing a ZFS-on-root install. This guide from ZFSBootMenu is what we’ll be following throughout this post. ↫ Juno Takano There’s a ton of good stuff in this lengthy, detailed, and helpful blog post. First, it covers Void Linux, which is one of the best signifiers of good taste, classy style, and generally being a good person. Void is not necessarily underappreciated – it gets a lot of mentions in the right places – but I do feel there are a lot more people for whom Void Linux would be a perfect fit but who don’t yet know about it. So, time for a very short introduction. Void Linux is distribution with its own unique and very user-friendly package manager that’s an absolute joy to use. Unlike many other custom, more obscure package formats, the Void repositories are vast, generally some of the most up-to-date, and you’ll be hard-pressed to be asking for some piece of software that isn’t packaged. Void eschews systemd in favour of runit, and while I personally have no issues with systemd, diversity is always welcome and runit is, in line with everything else Void, easy to grasp and use. Lastly, while Void also comes in a GNU libc flavour, it feels like the “real” Void Linux is the one using musl. Second is a tool I had never heard of: ZFSBootMenu. The name is rather self-explanatory, but in slightly more detail: it’s a self-contained small Linux-based bootloader that detects any Linux kernels and initramfs images on ZFS file systems, which can then be launched using kexec. It makes running Linux on ZFS quite a bit easier, especially for systems that don’t over ZFS as an option during installation, like, in this case, Void Linux. And that’s what the linked post is actually about: setting up a root-on-ZFS Void EFI installation. It’s a great companion article for anyone trying something similar.

Now that we have the MenuetOS 64 disk image file (M6414490.IMG), it is time to analyze! We will analyze the image file both statically and dynamically. Static analysis is reading and analyzing code without running it, whereas dynamic analysis is running the code and watching how it changes registers and memory during execution. Each analysis mode compliments the other; there are some things that can only be discerned through code execution, like register values or stack layout at a specific point in time during execution. Static analysis is useful for “filling in the blanks” when executing code to understand what the code should do next (or just did). Since MenuetOS 64 is written in Intel x64 assembly, our static analysis will consist of memory mapped disassembly in Ghidra. After reading this post, readers should understand how to launch a MenuetOS 64 virtual machine using QEMU as well as how to attach a debugger (gdb) to QEMU in order to debug while code is executing. Also, readers should understand how MenuetOS 64 begins the boot process as control of execution is passed to MenuetOS 64 code from the virtualization firmware. ↫ Nicholas Starke This is an old post – from late 2022 – but a great read nonetheless, and considering MenuetOS doesn’t change very much from year to year, it’s still mostly relevant.

Adobe Creative Cloud users opened their apps yesterday to find that they were forced to agree to new terms, which included some frightening-sounding language. It seemed to suggest Adobe was claiming rights over their work. Worse, there was no way to continue using the apps, to request support to clarify the terms, or even uninstall the apps, without agreeing to the terms. ↫ Ben Lovejoy at 9To5Mac Of course users were going to revolt. Even without the scary-sounding language, locking people out of their applications unless they agree to new terms is a terrible dark pattern, and something a lot of enterprise customers certainly aren’t going to be particularly happy about. I’ve never worked an office job, so how does stuff like this normally go? I’m assuming employees aren’t allowed to just accept new licensing terms from Adobe or whatever on their office computers? In response to the backlash, Adobe came out and said in a statement that it does not intend to claim ownership over anyone’s work, and that it’s not going to train its ML models on customers’ work either. The company states that to train its Firefly ML model, it only uses content it has properly licensed for it, as well as public domain content. Assuming Adobe is telling the truth, it seems the company at least understands the concept of consent, which is good news, and a breath of fresh air compared to crooks like OpenAI or GitHub. Content used for training ML models should be properly licensed for it, and consent should be properly obtained from rightsholders, and taking Adobe at their word, it seems that’s exactly what they’re doing. Regardless, the backlash illustrates once again just how – rightfully – weary people are of machine learning, and how their works might be illegally appropriated to train such models.

We haven’t been hearing much out of the Fuchsia team anymore after said team was hit hard by the Google layoffs, but we’ve got some news so my fancy Fuchsia database category doesn’t go entirely to waste. As Phoronix highlights, Fuchsia support is being upstreamed to Mesa 3D, indicating that no, Fuchsia is not entirely dead. This adds fairly standard support for Fuchsia in src/util. It’s being used in downstream forks of Lavapipe and it’s useful for gfxstream-vk. The idea is to incrementally merge these obvious changes to help reduce the patch load until someone has time to upstream the full driver. ↫ Gurchetan Singh As you can tell from the language here, we’re dealing with the first experimental steps, and a lot more work is required before full Fuchsia support can be added to Mesa 3D, as further evidenced by the various friendly conversations attached to the merge request. After some small changes to the code here and there, the code was merged a few days later, so it seems the process can continue. It used to be quite easy to predict where Fuchsia was going, since pretty much every indication was that Google had grand ideas for the project, and consequently, the Fuchsia team was large, staffed with well-known names, and the kind of progress we saw all pointed towards a role for Fuchsia on smartphones, tablets, laptops, desktops, and perhaps even beyond. There was a real sense that Google intended to almost silently replace the Linux base with Fuchsia in Android, and all the technologies to do so were either in place or actively being worked on. Then came Google’s massive layoffs, though, and the Fuchsia team was hit proportionally harder than other teams, and now, it’s not so clear anymore what the future has in store for this custom operating system. Several Fuchsia-related efforts were wound down, from no longer porting Chrome to Fuchsia to killing Fuchsia smart speaker efforts. This was one of the few truly interesting projects inside Google, and it presented a real chance that we might see a new major operating system enter the market, for the first time in decades. Alas, Google gonna Google.

It turns out that the storm of criticism Microsoft’s recently unveiled Recall feature has actually pushed Microsoft to change its mind and make some very significant changes to the feature. Today, after over a week of sustained criticism and worries, Redmond announced it’s going to implement Recall very differently. First and foremost, instead of Recall being enabled by default and only configurable after installation and the out-of-box experience, it will not be disabled by default, and the user will be prompted during the OOBE if they want to enable the feature or not. This in and of itself should alleviate quite a few worries, since having this on by default without most users really realising it was a recipe for disaster and privacy issues. Second, Recall will not be taking advantage of Windows Hello, and using Window Hello will be a requirement before you can use Recall. On op of that, Recall will use Windows Hello presence detection, so that it will only show any collected and saved data if you’re the one sitting behind the computer. It’s wild to me that they didn’t think of this one sooner, but alas – I have a feeling a lot of this “AI” stuff has been implemented in a bit of a hurry. Last but definitely not least, the Recall database, where information extracted from the screenshots is stored as well as the search index will now be properly encrypted. They will only be decrypted once the user in question is authenticated. Here, too, one really has to wonder why it wasn’t implemented this way from the very beginning, and the fact that it wasn’t makes me think we’ll be finding more questionable security and implementation details as the feature becomes widely available in a few weeks.

I bought a Topton GM1 Industrial Mini PC for my HomeLab. It is aimed at running Slackware Linux but I wanted to have a quick look at how well BSD OSes support it out-of-the-box. ↫ Joel Carnat That’s really all there’s to this story. I just really, really love tiny industrial and office computers and thin clients, and every time I see another one for sale I really have to stop myself from buying one I have absolutely no use for. There’s just something about how these little guys are built that speaks to me – they’re different than regular PCs, but only marginally so, making them fun to play around with, getting drivers for everything, seeing if Linux and BSD have any issues with it, and so on. They’re also often fanless, which is a major boon. The Dell thin client I wrote about last week has been run through a gauntlet of operating systems to see just how capable it is, and I’m surprise by just how much you can do even with a pedestrian Pentium Silver. For now it’s running Fedora GNOME to get an idea how the most default of default Linux environments performs and feels – so I can include it in future articles about it – but I think I’m going to set it up as a retrogaming console using Batocera. Industrial, office, and thin client computers are just fun to play around with, and they’re incredibly cheap when buying used. If things like a Raspberry Pi are hard to get, backordered, or overpriced due to demand outstripping supply, it’s definitely a good idea to see if you can find some cast-off thin client or whatever for your project instead.

As some of you will know, I recently started working on OSNews as my full-time job, and that means I sometimes need to be annoying and remind you all that I need your help in keeping the website going. Ad income has been going down the drain for years and years now, so your support is crucial in keeping OSNews online. We’ve been providing you with the latest technology news for over 25 years now, and I’d really like to keep things going for another 25 years. So, how can you help? You can become an OSNews Patreon, which will remove ads from OSNews, and give you a little bit of flair on every comment you post to show off that you support us. We offer three pricing tiers with an increasing level of prominence for your flair, with the highest tier giving you the option of choosing your own flair to really show off to your fellow readers and commenters that you are just a little bit more equal than everyone else. You can also make individual donations through Ko-Fi. Since I really need to replace the monitor of my OSNews workstation – after eight years of loyal use, the cheap monitor is started to show ghosting and flickering, and I feel like it could give out at any moment – I’ve set a goal on Ko-Fi for this very purpose. I don’t expect this goal to be met any time soon, but it’s a nice target to aim for and look forward to. I intend to replace the old 4K display with the cheapest 4K/144Hz panel I can find here in Sweden, but since that will most likely be unrealistic price-wise, the goal is rooted more in aspiration than reality. There are other ways to support us too – you can make a donation through Liberapay, or go to our merch store and buy T-shirts, mugs, and other cool items. The ultimate goal that I’m working towards is to eventually be able to offer ad-free by default, fully supported by you, our generous readers. This is a long-term goal and not something we’ll achieve overnight, but I want to maintain OSNews’ independence at all costs. Virtually every other technology news site you visit is part of a major media empire, such as The Verge or Ars Technica, with huge amounts of staff and massive funds backing them – and all the questionable relationships between writers and the technology companies that entails. Add to it the rise of artificial intelligence and the negative consequences that’s going to have, and the need for independent, reader-funded technology websites is greater than ever. That being said, we will not be gating content behind paywalls, so even if you cannot or are unwilling to support us, you will still get all the same content as everyone else. As such, supporting OSNews financially is entirely optional, and will not degrade your experience in any way. Still, OSNews’ continued existence is entirely dependent on me being able to generate enough income through it, so while you do not have to support us, it’s definitely needed.

I’ve barely scratched the surface, but there’s enough here for me to seriously consider a switch to it as my primary Linux distro for testing and servers. I love that htop(1) and lsof(1) only shows a small list of recognisable processes, that it uses OpenRC, that package management seems straight forward, and that it’s so simple to configure. I’ve wondered what a modern, functional “Occam’s Linux” would look like. This is it. ↫ Ruben Schade Alpine is very popular among people inclined towards BSD, but who still want to run Linux as well – and it’s easy to see why when you try it out or read about it. This article is a good jumping-off point for those of you curious about Alpine.

Starlark is a small programming language, designed as a simple dialect of Python and intended primarily for embedded use in applications. Some people might say it’s a bit like Lua with Python syntax, but I think there are many interesting bits to discuss. The language is now open-source and used in many other applications and companies. As I led the design and implementation of Starlark, I’d like to write a bit more about it. ↫ Laurent Le Brun I’m sure there’s a few among you will like this.

The short version is this: In its current form, Recall takes screenshots and uses OCR to grab the information on your screen; it then writes the contents of windows plus records of different user interactions in a locally stored SQLite database to track your activity. Data is stored on a per-app basis, presumably to make it easier for Microsoft’s app-exclusion feature to work. Beaumont says “several days” of data amounted to a database around 90KB in size. In our usage, screenshots taken by Recall on a PC with a 2560×1440 screen come in at 500KB or 600KB apiece (Recall saves screenshots at your PC’s native resolution, minus the taskbar area). Recall works locally thanks to Azure AI code that runs on your device, and it works without Internet connectivity and without a Microsoft account. Data is encrypted at rest, sort of, at least insofar as your entire drive is generally encrypted when your PC is either signed into a Microsoft account or has Bitlocker turned on. But in its current form, Beaumont says Recall has “gaps you can drive a plane through” that make it trivially easy to grab and scan through a user’s Recall database if you either (1) have local access to the machine and can log into any account (not just the account of the user whose database you’re trying to see), or (2) are using a PC infected with some kind of info-stealer virus that can quickly transfer the SQLite database to another system. ↫ Andrew Cunningham at Ars Technica It really does seem Recall is kind of a mess in the security department, and it has a certain rushed quality about it. All the screenshots are saved in an AppData folder, and data pulled from those screenshots is stored in a local SQLite database that happens to be entirely unencrypted. TotalRecall, a tool developed by Alexander Hagenah, will neatly pull the data from Recall for you without any hassle or issues. This truly is a security nightmare. Aside from all the obvious issues this presents, such as making it even easier for law enforcement to gain access to pretty much everything you do online, something especially troubling for minorities or in countries with less-than-stellar police departments, Recall also presents a whole host of other problems. Imagine being in an abusive relationship, and the abusive partner demanding Recall be left on at all times to exert even more control. Imagine an unscrupulous employee abusing Recall to steal sensitive information from a company for a competitor. Imagine living in some backwards part of a country with controlling religious parents, and you happen to be gay. The problems here are endless. The fact you can turn Recall off doesn’t mean much, since in the above examples, turning it off is not an option since there are controlling people involved who will demand you keep it on. Browser history and other forms of history in your computer exist as well, of course, but they’re not always as easy to parse, they’re easier to manipulate, sanitise, and temporarily hide. Recall just combines all of this and puts a neat little bow on it, ready to be abused by anyone with bad intentions. Recall is ill-conceived, badly implemented, and a solution looking for a problem, that in an of itself creates tons of other problems. I hope Microsoft reconsiders, but in a world where “AI” makes investors go nuts, I doubt we’ll see a sudden sense of clarity coming out of Redmond.