Category: News

texinfo @ Savannah: Texinfo 7.1.1 released

Posted on by Michael G

We have released version 7.1.1 of Texinfo, the GNU documentation format. This is a minor bug-fix release.

It’s available via a mirror (xz is much smaller than gz, but gz is available too just in case):

http://ftpmirror.gnu.org/texinfo/texinfo-7.1.1.tar.xz

http://ftpmirror.gnu.org/texinfo/texinfo-7.1.1.tar.gz

Please send any comments to bug-texinfo@gnu.org.

Full announcement:

https://lists.gnu.org/archive/html/bug-texinfo/2024-09/msg00041.html

Keyhole: a highly effective Windows DRM bypass also present on the Xbox One

Posted on by Michael G
The MAS project, a group of people working on an open source Windows and Office activator featuring HWID, Ohook, KMS38, and Online KMS activation methods, discovered quite a neat and interesting bug in the code responsible for licensing in Windows. In our ongoing work to bypass Windows licensing checks, we occasionally stumble upon bugs that we choose to keep secret. This decision allows us to preserve potential future activation methods by avoiding bug fixes, while also giving us valuable tools for testing or developing new methods. One such discovery, which we’ve named “Keyhole”, turned out to be a highly effective DRM bypass. It gave users the ability to license any Microsoft Store app or any modern Windows edition with ease. ↫ The MAS project There were quite a number of roadblocks to overcome here, such as Microsoft’s code obfuscation tool, called Warbird, which was already done by someone else, after which they could really start digging into the code responsible for handling Microsoft Store and Windows licenses. They then discovered that circumventing the license blocks that hold the actual license information was dead simple – every license block is followed by a signature block covering all the data that comes before it. It turns out that messing with the licensing system was as simple as… Adding data after that signature block. That was it. As it turns out, data after the signature block isnt checked at all… and it can even override data that came before it. Whenever two blocks of the same type are stored together, the last one overrides all the others before it. So, if we want to change any license data, we can just make a block for it and put it after the signature block! This method lets us make licenses for anything sold on the Microsoft Store, including Windows, from any other Microsoft Store license. And since there are so many free apps with licenses, we now had the ability to make as many as we wanted for whatever we wanted. This bug essentially punched a hole straight through CLiP’s DRM, so we decided to name it “Keyhole”. ↫ The MAS project This opened up a massive hole in Microsoft’s licensing tools and DRM, and allowed the MAS project to pretty much do whatever they wanted. They could even do things that used to be impossible, such as “activating Enterprise LTSC with a digital license, or even activating a legitimate KMS server with a generic key”. Sadly, the fun didn’t last long, as right around the same time, Cisco TALOS discovered this same bug, reported it to Microsoft, who then proceeded to fix it. the MAS project also discovered something else incredibly interesting, something which further highlights the seemingly terrible lack of quality assurance and code quality inside Microsoft. They noted that the kernel driver responsible for licensing looked incredibly shoddy, full of what they call “odd choices and compromises”. In fact, they soon realised that they had seen this code before: it was a straight-up copy/paste job from the licensing DRM found on the Xbox One. And there’s the same bug that’s in CLiP, but in Xbox code. In fact, we weren’t too surprised to find this, as we found that almost all of CLiP, from the XML format of the licenses to the TLV-based license blocks, is copy-pasted straight from the Xbox One’s DRM system. ↫ The MAS project Code reuse obviously makes sense in some situations, but the fact Microsoft even copy/pasted entire sections of code from the Xbox One straight into the Windows kernel as a kernel driver seems rather irresponsible. Shouldn’t code added to the Windows kernel and installed on billions of devices be vetted a little better than this?

Wim Leers: XB week 14: early christmas tree

Posted on by Michael G

How does cta1href sound to you? Gibberish, right? 😀
Jesse “jessebaker” Baker pointed out that Experience Builder (XB) in its current state was subjecting its users to such nonsense! Fortunately, thanks to every Single Directory Component (SDC) specifying a title for each prop, we were able to automatically generate the much more readable CTA 1 link — thanks to foundations Ben “bnjmnm” Mullins did in #3461422 from 3 weeks prior.

Utkarsh “utkarsh_33” and Omkar “omkar-pd” Deshpande eliminated an extraneous “preview” request from the client, hence improving performance (as well as sanity).

Ben & Jesse made XB’s Cypress end-to-end tests leap massively ahead (especially compared to Drupal core’s use of Nightwatch), by introducing cypress-terminal-report. The resulting test failure output on GitLab CI makes it far easier to figure out where something is going wrong: a big productivity boost!

Two weeks ago I alluded to it, and now it finally happened: after months of getting basic infrastructure off the ground, we now finally were able to Kyle “ctrladel” Einecker’s set of representative SDCs that Lauri approved, Ivan “finnsky” Berdinsky and I reviewed, and Ted “tedbow” Bowman pushed across the finish line.
(Not everything Kyle proposed landed, because XB and the SDC subsystem do not yet have all the capabilities needed for some of the SDCs he wrote — see the follow-up if you’re interested.)

Wim Leers: XB week 14: early christmas tree
The very first component tree rendered in Experience Builder: both slots of this ‘two column’ SDC contain other SDCs!
Issue #3446722, image by me.

Some of the people working full-time on XB are doing so using DDEV. And running end-to-end tests that use WebDriver with both the test runner and the system under test living in a Docker container turns out to be quite challenging! Besides us, we know that many (most?) in the community use a DDEV-based development environment, and we’d love to welcome as many contributors as possible. Not being able to run the most important tests of all then is of course quite a problem.
That’s why Travis “traviscarden” Carden had been diligently (he actually joined a few weeks ago!) working on making that painless. The result: the ddev-drupal-xb-dev DDEV add-on — once installed, running (and seeing!) the XB end-to-end tests requires only ddev xb-cypress-open 🙂

Feliksas “f.mazeikis” Mazeikis is back full-time on XB, and he’s started working on the super important #3463999: Auto-create/update Component config entities for all discovered SDCs that meet XB’s minimum criteria. It’s a critical piece in making Lauri’s product vision come to life: it will ensure that any SDC that we’re confident will work in XB becomes available automatically.1 While working on that, he discovered that there was a pretty big oversight in the StorablePropShape work I landed two weeks ago: in some places Drupal core does not distinguish between “instance settings” and “storage settings” at all (and nor did the code I landed then), but in some places it actually does. Felix was running into that now, thanks to config validation, and so he fixed that.

Many of the things that happened this week were on the “enablement” side of things. Nonetheless, the XB UI also made progress:

  1. Harumi “hooroomoo” Jang and Jesse landed the updated “insert” UX and hierarchy view, based on the updated design.
  2. But, most importantly, nicely rounding out this post by combining “enablement” and improved UX: Bálint “balintbrews” Kléri implemented error boundaries. In principle, you should never see these, but we all occasionally have internet connection issues. At those times, Bálint’s “Try again” addition works beautifully 🙂
    (And as a bonus it accelerates debugging failing server responses!)
Error boundaries with a friendly 'Try again'.
Error boundaries with a friendly ‘Try again’.
Issue #3461431, image by Bálint.

Thanks to Travis for reviewing this!

Week 14 was August 12–18, 2024.

  1. At this early stage, it’ll happen indiscriminately. Later, we’ll ensure that on production environments no new SDCs will be made available to the Content Creator without explicit approval by the Site Builder. See the first steps towards auditability of the available XB components if you’re interested in this aspect. ↩︎

Xmem and FVWM

Posted on by Michael G
So given that, xmem can be useful as a monitoring tool. Fluffy (my main server) runs both squid and apache, and given that fluffy only has 64MB of RAM, things can get a little cramped. If I suddenly see that the whole of xmem turns blue (i.e. the swap file’s thrashing), then I know that something is odd, and I can easily find out which processes are eating up so much RAM. I said earlier that xmem can brighten up one’s desktop. Indeed, as I use FVWM in a rather archaic fashion, it seems fitting I should like xmem. 🙂 Here’s a full screenshot showing xmem (plus other applications) in action. ↫ Thomas Adam This is basically just an excuse to show off this awesome FVWM desktop shown off in this short little article about xmem, written by one of FVWM’s core developers. It just looks neat.

Vinteum lança programa para capacitar desenvolvedores brasileiros de Bitcoin.

Posted on by Michael G
Fechamento Invest “Setembro” (05/09/24).

https://youtube.com/shorts/P-qYBri6VSk?si=rIPReEDAt6RABtFI

Ibovespa fecha em alta com Vale (VALE3) e grandes bancos; dólar despenca.

O Ibovespa encerrou as negociações desta quinta-feira (5) em alta pelo segundo pregão consecutivo. O principal índice acionário da bolsa brasileira avançou 0,29%, aos 136.502,49 pontos.

Durante a sessão, o índice Bovespa oscilou entre a mínima de 135.959,32 pontos e a máxima de 136.656,04 pontos. O volume financeiro do dia foi de R$ 18,30 bilhões.

———————————————————————————-

Vinteum lança programa para capacitar desenvolvedores brasileiros de Bitcoin.

O programa gratuito quer oferecer uma oportunidade para programadores que desejam aprofundar seus conhecimentos e contribuir com o ecossistema Bitcoin.

A Vinteum, organização sem fins lucrativos dedicada a impulsionar o desenvolvimento do Bitcoin no Brasil e na América Latina, anuncia o lançamento do Bitcoin Dev Launchpad, um programa gratuito intensivo de três meses para capacitar programadores brasileiros em projetos open-source no ecossistema Bitcoin e Lightning Network.

As inscrições já estão abertas e vão até o dia 2 de outubro. O programa gratuito, que começa no dia 18 de novembro, oferece uma oportunidade para programadores com, no mínimo de 2 anos de experiência, que desejam aprofundar seus conhecimentos e contribuir com o ecossistema Bitcoin.

#FechamentoInvest
#multinvestidor
#fechamentomercado
#fechamentodemercado
#mercadofinanceiro
#bolsadevalores
#ibovespa
#dólar
#mercadoamericano
#nyse
#nasdaq
#dowjones
#bitcoin
#criptomoedas
#criptoativos