Category Archives: Cloud Hosting
Ubuntu desktop team teases ‘proof of concept’ systemd on Windows Subsystem for Linux – The Register
Canonical may be working on introducing systemd to Ubuntu on Windows Subsystem for Linux (WSL), according to a post by Ubuntu Desktop Team Technical Leader Didier Roche.
Roche's remarks were posted on the Ubuntu Desktop Team Updates two days ago. "PoC of systemd on WSL at startup of an instance," he said, raising hopes (or fears) that the component will be introduced in a future WSL 2 update. The remark was first spotted by Phoronix.
Systemd manages services and other system software on Linux, and is widely used by the most popular distributions, such as Debian, Ubuntu, SUSE, and the Red Hat family. The original WSL did not support systemd for technical reasons, starting with the fact it had its own init process.
When WSL 2 was introduced, with a new container-based model for running Linux on Windows, supporting systemd seemed feasible (Linux distros running on Micrsoft's Hyper-V hypervisor have no problem with it) but Microsoft continued with its own init presumably for reasons related to the integration between WSL and the rest of Windows.
WSL 2 users though have frequently requested systemd support. The reasons are many and varied, but the lack of systemd does introduce friction for users familiar with other distros that include it. Canonical's Snap packaging system depends on systemd, and since Canonical regards Snap as the future of application deployment one can understand why the company is keen to have it supported in WSL, particularly now that GUI Linux applications are supported in Windows 11.
Another problem is that users do not always realise that commands they use like systemctl for managing services are actually part of systemd. As far as some are concerned, this is a bug in WSL 2, in this case because an attempt to start the SSH daemon gave the error, "System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down."
There are a number of workarounds to enable systemd on WSL 2 but an official solution would still be welcome.
It is important that systemd does not only run, but runs as PID 1, the first process in the operating system. A developer has come up with a project called genie to ensure this happens.
Then there's Distrod, which is described as "a systemd-based meta-distro for WSL2 that allows you to install Ubuntu, Arch Linux, Gentoo and many other distros with systemd in a minute, or make your current distro run systemd." We note such solutions are unofficial.
Here's Distrod, one of several unofficial solutions for systemd on Windows Subsystem for Linux 2
Both projects work by introducing another container. Distrod, for example, "is a binary that creates a simple container that runs systemd as an init process, and starts your WSL sessions within that container." According to its author, even WSLg, for GUI desktop application support, works with Distrod. Genie, so called because it creates a systemd "bottle," also works with WSLg but the docs state that "Linux GUI apps started from the Windows Start Menu items created by WSLg will run outside the bottle."
Canonical is not Microsoft, of course, but has worked closely with the WSL team. There is little doubt that systemd in WSL 2 is a desirable feature for various users, at least as an option, so we will be watching progress with interest.
Read the rest here:
Ubuntu desktop team teases 'proof of concept' systemd on Windows Subsystem for Linux - The Register
Intel audio drivers give Windows 11 the blues and Microsoft Installer borked following security update – The Register
Windows 11 has continued to notch up known issues as Microsoft admitted to problems in the Intel Smart Sound department and Microsoft Installer following a security update.
The former turned up earlier this week, when Microsoft realised that "certain versions" of drivers for Intel Smart Sound Technology (SST) could tip Windows 11 into a blue screen (of death). The driver involved is IntcAudioBus.sys and file versions 10.29.0.5152 and earlier or 10.30.0.5152 and earlier are affected.
The workaround is, unsurprisingly, to get an updated driver from one's OEM. 10.30.00.5714 and later or 10.29.00.5714 and later should do it, according to Microsoft. Slightly confusingly, "for addressing this issue, 10.30.x versions are not newer than 10.29.x versions." The key bit is the last of the version number.
While a compatibility block was flung up to prevent any more users with sound drivers not to Windows 11's taste updating the OS, others optimistically applying the company's security patches may not have been so lucky.
KB5007215 was dispensed to the faithful on 9 November and, as well as noting problems with connecting to print servers in the patch's known issues, yesterday Microsoft had to add one of its side effects to the Windows release health dashboard. In this case the Microsoft Installer has been left unwell following the update (or its later siblings) and could "have issues repairing or updating apps."
One of the affected apps is part of Kaspersky's Endpoint Security 11 for Windows. Kaspersky noted that while its app would remain functioning correctly, problems might happen when updating or changing the scope of the application.
Kaspersky's recommendation is to temporarily hold off from the update (Microsoft said it is "working on a resolution and will provide a new update in an upcoming release"). Otherwise the mitigation appears to be an uninstall and reinstall of the afflicted application.
Very much the software equivalent of turning it off and on again. Even in 2021, the old ways remain the best, it seems.
See the rest here:
Intel audio drivers give Windows 11 the blues and Microsoft Installer borked following security update - The Register
Netlify acquires OneGraph: One API to rule them all? – The Register
Interview Netlify has acquired OneGraph, which provides a GraphQL API that wraps the APIs of third-party services, as well as launching a new Jamstack innovation fund for startups.
Jamstack is an architectural approach for web applications where static web pages retrieve dynamic content by calling APIs, hence "JavaScript, APIs and Markup." A web server is not required and Jamstack sites are amenable to acceleration via a content delivery network (CDN), but server-side logic still exists, in the APIs that are called, and these become the potential bottleneck.
"The Jamstack and the architectural approach behind that has really changed the direction of the modern web, and this move towards decoupling the web UI layer from the back end infrastructure layer and splitting up all these different APIs and services is an architectural tendency that's only getting stronger," Matt Biilmann, Netlify CEO and co-founder, tells The Register.
Chris Bach, also a Netlify co-founder and now its chief strategy & creative officer, says Jamstack is "a much better way to build the web. It's scalable, it's more performant, it's faster to iterate on, it's more compatible, the workflow is way safer."
Netlify is a hosting company for Jamstack applications built with React, Next.js, Angular, Vue.js, Gatsby, and other frameworks. The company packages build services, serverless functions (which run on AWS Lambda), and a CDN for deployment.
The company has now acquired OneGraph, whose goal is "to put all of the internet's APIs under a single GraphQL endpoint."
The service will not be integrated immediately, but there is an initial beta launch of API authentication with Stripe, Spotify, GitHub, and Salesforce, creating an authentication token that can be used with Netlify serverless functions. However, this only does authentication and does not wrap the third-party API. A limitation of the beta is that "you can only log in with your own credentials and can't proxy site visitor credentials," making it of limited use in many scenarios.
Netlify API authentication, the first piece of OneGraph integration
Future plans are more comprehensive. "What if we could put all the world's APIs and services behind one GraphQL endpoint," Biilmann says, to give teams "one framework for how to talk to them, how to authenticate with them, and how to build with them."
The reality is that it is early days, and much will depend on third-party support for OneGraph. "It will be important that we can allow external providers to plug into our platform and extend it," Biilmann adds, "to live up to its full potential."
The big cloud providers are also offering Jamstack platforms, such as AWS Amplify and Azure Static Apps, so the space is getting more competition.
What if we could put all the world's APIs and services behind one GraphQL endpoint?
The company says it's also rolled out a new $10m Jamstack Innovation Fund, which offers startups up to $100,000. What are the missing pieces in the Jamstack ecosystem that this may help address? "We're seeing the API-ification of everything," Biilmann says. "Content has moved to headless solutions, and now we're seeing the same thing happening for commerce across a lot of different sectors so we want to see a very broad ecosystem emerging."
The company has scored one major win recently: Twilio has migrated its developer console to Jamstack and Netlify, claiming faster deployment cycles, from once a week to 10 to 15 times per day, and much faster render times.
What about enterprise development? Front-end developers find a GraphQL API easy to work with, Biilmann says, but "for back-end teams building APIs and services, we're seeing that exposing them as GraphQL services tends to be harder." This challenge is one of the things new startups may help address, he adds.
Jamstack, according to Biilmann, is the web fighting back against proprietary platforms. "The web is an unique platform in not being owned by a single company. We're investing in this to see the web become a better platform, to make sure that as new devices and new delivery landscapes like metaverse arrive, that the web is still the best way to build and operate your applications."
That said, the curious thing is that Netlify sees itself as a kind of platform of platforms, which is in part proprietary. Bach tells The Reg that "Netlify has become this aggregator of all these big interesting projects." Is that in itself a proprietary layer?
Answering a question about open source, Biilmann says that "the layer of the stack we are building, the full infrastructure automation and workflow layer, that's inherently a layer where to build that as a proprietary platform makes sense, because it's a globally distributed platform requiring a lot of operations and maintenance and vigilance.
"All the tooling around that, even stuff like our build plugins, framework and so on, we make that available to everyone as open source I don't think developers want to work with proprietary frameworks and libraries."
More here:
Netlify acquires OneGraph: One API to rule them all? - The Register
Thousands of Firefox users accidentally commit login cookies on GitHub – The Register
Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions.
These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork."
Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program."
Marlin then asked whether he could make his findings public and was told he's free to do so.
"I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants."
Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake.
Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."
GitHub dorks are not new, but they often only affect a single service, like AWS, Marlin said. This particular gaffe is troubling because it could allow an attacker to access any internet-facing website to which the GitHub user was authenticated at the time the cookie files were committed. He added that dorks for other browsers can probably also be found.
Exploitation, Marlin said, would be very easy. It's just a matter of creating a new Firefox profile on your local machine and then downloading the cookies.sqlite file and placing it within the Firefox profile folder. "You'll be authenticated on any services which the user was logged in on when they committed the database," explained Marlin.
There's a theoretical complication. Firefox offers an option to protect logins and passwords. But as far as we can tell, that doesn't apply to the cookies.sqlite file. The Register was able to examine multiple Firefox cookie databases with Marlin's guidance.
When the visibility of cookies came up five years ago as a Firefox macOS bug submission, it was closed.
And even if the cookies.sqlite file were protected by a database-specific password, it probably wouldn't offer much protection: Various open source projects offer the ability to crack .sqlite files, and there are commercial offerings of this sort too.
To underscore the seriousness of exposing these databases, consider this recently described Android PoC exploit of CVE-202015647, used to exfiltrate the Firefox cookies database.
Mozilla confirmed Marlin's claims about the risk of exposing these files in an email to The Register on Thursday.
"Protecting the privacy of internet users is at the core of Mozillas work," a Mozilla spokesperson said. "When using code hosting services, we encourage users to use caution when considering the sharing of private data directly on public websites. When choosing to backup sensitive Firefox profile data, Mozilla recommends Firefox Sync, which encrypts and safely stores files within Firefox servers."
One mitigating factor at least is that sessions and associated cookies tend to expire relatively quickly.
There's precedent for GitHub to take action to help those who have been unwittingly publishing their cookie databases. The social code biz has been scanning for exposed credentials in repos since 2015 and now scans for more than 70 different types of secrets. Here's one more to add to the list.
GitHub did not respond to a request for comment.
See the original post:
Thousands of Firefox users accidentally commit login cookies on GitHub - The Register
Boffins find way to use a standard smartphone to find hidden spy cams – The Register
Recent model smartphones can be smarter still about finding hidden cameras in their vicinity, if they take advantage of time-of-flight (ToF) sensors.
ToF is a measurement technique that relies on reflected light to quickly determine the distance of objects. ToF sensors are used in LIDAR (light detection and ranging) systems and in other applications that utilize SLAM (simultaneous localization and mapping) algorithms, all of which involve the analysis of the visible and near-visible spectrum.
These sensors have started showing up in smartphones recently Apple's iPhone 12 and 13, and Samsung's Galaxy S20+, among others, include a laser-based Sony ToF sensor for augmented reality applications and adding depth information to 2D imagery.
Now, four researchers based in Singapore and South Korea have another application in mind: They see ToF sensors as a way to spot concealed cameras.
Sriram Sami, Bangjie Sun, and Sean Rui Xiang Tan, from National University of Singapore, and Jun Han from Yonsei University, describe how this might be done in a paper [PDF] titled "LAPD: Hidden Spy Camera Detection using Smartphone Time-of-Flight Sensors".
Their research was presented at the 19th ACM Conference on Embedded Networked Sensor Systems earlier this week. You can see the pitch below.
Youtube Video
LAPD in this context has nothing to do with the Los Angeles Police Department, a likely association at least for US readers reared on Hollywood police procedurals. Rather, it stands for Laser-Assisted Photography Detection a technique for ferreting out tiny concealed lenses by checking for unusually intense reflections in the scanned area.
Surreptitious spying with hidden cameras has become a global concern, according to the boffins.
"Tiny hidden spy cameras placed in sensitive locations such as hotel rooms and lavatories are increasingly a threat to individual privacy globally," the research paper explains. "For example, in South Korea alone, there were over 6,800 such reported cases in a single year."
Salacious snooping has become a particular issue for users of services like AirBnB, where the platform operator doesn't control room providers or guarantee trustworthiness.
There are dedicated signal detection devices for finding hidden cameras and other electronics like the CC308+ and the K18, to say nothing of what can be done with open source Wi-Fi analysis software.
But the researchers contend these can be difficult to use correctly. What's more, smartphones are commonplace these days, so adding an app like LAPD is likely to be more convenient than carrying a dedicated bug or signal detector at all times. LAPD's goal is to be accessible, usable, and accurate, and to judge by the results reported in the paper, it hits those marks.
"From our comprehensive experiments, LAPD achieves an 88.9 per cent hidden camera detection rate, compared to just using the naked eye which yields only a 46.0 per cent hidden camera detection rate," the paper reads.
The dedicated K18 signal detector managed detection rates of 62.3 per cent and 57.7 per cent using its continuous and blinking methods respectively.
And boffins' LAPD method produced the lowest overall false positive rate (16.67 per cent), compared to the two K18 modes (26.9 per cent and 35.2 per cent) and to the naked eye (54.9 per cent). The technique's strong results follow from its use of a deep learning filter that's been trained to remove false positives.
Sriram Sami, one of the researchers, told The Register in an email that he feels this project is a way to address what he described as asymmetric warfare.
"The 'attackers' have all the power to place hidden cameras anywhere, and the public is, in contrast, generally defenseless," he explained. "That's why we're doing this work, and why we hope hidden camera detection can become more commonplace."
Sami said he intends to release the source code for LAPD but has to coordinate that with his colleagues.
The rest is here:
Boffins find way to use a standard smartphone to find hidden spy cams - The Register
America, when you’re done hitting us with the ban hammer, see these on-prem Zoom vulns, says Positive – The Register
US-sanctioned Positive Technologies has pointed out three vulnerabilities in Zoom that can be exploited to crash or hijack on-prem instances of the videoconferencing system.
One of the trio of bugs is an input validation flaw, which can be abused by a malicious Zoom portal administrator to inject and execute arbitrary commands on the machine hosting the software. We imagine a scenario in which someone in, say, HR is made an admin of the company Zoom installation, and their work PC is hijacked by a miscreant who then exploits this vulnerability to get a foothold on an internal server system, and go exploring from there.
The vulnerability, tracked as CVE-2021-34414, was patched in September.
"You can often encounter vulnerabilities of this class in apps to which server administration tasks have been delegated," Positive Technologies researcher Egor Dimitrenko said of the vuln.
"This vulnerability always leads to critical consequences and, in most instances, it results in intruders gaining full control over the corporate network infrastructure."
Zoom offers an on-premise option for enterprises and one of its main advantages, said the company in marketing literature, is that meeting traffic (but not user metadata) stays within the host org's private cloud. Its three components are the On-Premise Meeting Connector, Virtual Room Connector, and Recording Connector.
Dimitrenko and his Positive Technologies comrades were able, so they said, to exploit improper input validation in the on-prem component of Zoom to obtain server-level access. Two related holes, CVE-2021-34415 and CVE-2021-34416, could be exploited to crash Zoom.
The vulns affected:
If your org has an on-prem Zoom deployment, now is a good time to check its update status.
Zoom spokesman Matt Nagel told The Register: "Zoom takes the security of its platform very seriously, and has addressed these issues. We recommend users stay up to date with the latest version of Zoom to take advantage of our newest features and security updates."
Positive Technologies is a Russian infosec company that was repeatedly targeted by the US government for sanctions this year. In April the firm was accused of helping recruit people into Russian state hacking agencies, while earlier this month Positive joined Israeli spyware vendor NSO Group on the US State Department's Entity List, a naughty step for firms banned from conducting financial transactions with American companies.
This doesn't appear to have slowed the outfit's enthusiasm for security research: when the sanctions were initially slapped on it, Positive described them as "groundless accusations," making comparisons with US attitudes to Chinese tech vendor Huawei.
In October Positive did the world a genuine favor by revealing a vulnerability in ancient shareware file compression utility WinRAR, still used today by those who rely on the .rar format.
See the rest here:
America, when you're done hitting us with the ban hammer, see these on-prem Zoom vulns, says Positive - The Register
Everything but the catch: ’90s pop act or a successful mission for Rocket Lab? – The Register
Rounding out a successful launch this morning, Rocket Lab has made good on CEO Peter Beck's promise to do pretty much everything bar catching the returning Electron booster in the company's recovery efforts.
An awful lot was riding on the mission, which placed a pair of BlackSky satellites into orbit and was dubbed "Love at first Insight." It was the second launch since a BlackSky payload was lost on May's "Running Out Of Toes" mission after a second-stage failure. In total, Rocket Lab has launched 22 Electrons and lost three (including the first, a test mission named "It's a Test").
Rocket Lab has been iterating its recovery plans; despite the failure of "Running Out Of Toes", the first stage managed a soft ocean landing by parachute. It is also almost a year since the first ocean landing as part of the "Return To Sender" mission.
The eventual goal is to snag an Electron booster by helicopter as it descends, something ebullient Rocket Lab boss Beck told us was "not that hard" ahead of the launch.
The success of this morning's efforts means that a recovery attempt is not far off.
As for the launch itself, which was from Rocket Lab's Launch Complex 1 on New Zealand's Mahia Peninsula at 01:38 UTC this morning, the Electron delivered the two Earth-Imaging satellites to a 430km orbit. The first stage then returned to Earth, descending to the ocean by parachute while being tracked by the recovery helicopter.
Unlike the propulsive antics of SpaceX's Falcon 9, the comparatively diminutive Electron will require aerial capture. The plan is then to refurbish the booster and refly it, further bringing down costs for the small-satellite launcher.
The next Electron launch (another BlackSky mission) is set for December, however, that recovery attempt will have to wait until 2022. As Beck observed: "We are all excited to move onto the next phase of reusability next year: catching Electron in the air with a helicopter."
Go here to read the rest:
Everything but the catch: '90s pop act or a successful mission for Rocket Lab? - The Register
Ready, player anyone? China’s gaming ban left cloud providers looking for someone to play with – The Register
China's decision to limit minors to three hours of gaming each week has proven problematic for the nation's clouds, which find themselves with unused capacity.
So said Steve Brazier, CEO of channel-centric analyst firm Canalys, at the company's Asia-Pacific Forum
"25 to 30 per cent of Chinese cloud capacity was for gaming," Brazier said. Chinese clouds like Alibaba are now trying to figure out what to do with that capacity. Some have even deferred datacentre builds as a result, Brazier said.
The CEO rated China's increasingly strong data privacy regulations, and actions to limit the market power of local tech giants, as "bold" and suggested the global tech industry should brace for more regulations in more nations.
Brazier also added a little to his remarks at the EMEA version of the Forum in October 2021, suggesting that as the pandemic wanes and businesses resume attendance in their offices, spending on Wi-Fi and collaboration kit will soar. Supply chain challenges, however, will mean that vendors pick and choose whose orders they fulfil.
Enterprises, Brazier said, are generally higher up the pecking order as vendors sell direct when they can a trend illustrated by smartphone vendors choosing to deal with their giant carrier customers before they send product to distributors that serve smaller resellers.
Small to medium businesses must make do with whatever kit their preferred resellers can secure if those resellers can develop the procurement skills needed to get kit through the door at all.
If resellers can't get the product end users want, Brazier said, they'll offer customers equivalents and charge like wounded bulls.
"We have taken price out the equation for the first time in years," he told resellers.
The ability to charge more means the IT services industry has decoupled its growth from trends in gross domestic product. Despite inflation, stock market uncertainty, and the lingering effects of the pandemic, Brazier predicted IT services businesses will thrive in coming years. And end users will pay for it to happen although perhaps not China's cloud providers.
VMware pulls vSphere update that only made things worse – The Register
So this is awkward for VMware. The virtualization giant has pulled an update to its flagship vSphere suite because it didn't fix the problems it was released to address, and may have made them worse.
The upgrade was vSphere 7 Update 3b, which on November 15 was the subject of a VMware blog post headed "Important Update." It offered a fix for issues that could cause vSphere to crash, or prevent some upgrades from completing successfully. That post has been taken down but The Register retrieved it [PDF] from Google's cache.
vSphere 7 Update 3b has also disappeared. VMware's Knowledge Base page states it's been pulled "due to further complications with HA configuration post upgrade."
The release was intended to address a known issue that prevented vSphere being placed into high availability mode after upgrades to vSphere 7 Update 3. Update 3b also addressed a problem that could cause a Purple Screen of Death (VMware's equivalent to Microsoft's BSoD) when virtual machines on a VMFS6 thin disk execute UNMAP/TRIM functions.
Another fix in 3b addressed the fact that the inbox i40enu network driver for ESXi's name was changed to i40en, which prevented the hypervisor from updating. 3b also corrected a vSphere problem that blocked the SMB protocol and broke some backups.
Virtzilla hasn't said what it will offer in place of Update 3b, nor when a replacement will arrive.
That's a tad embarrassing, for two reasons.
One is that VMware billed vSphere 7 Update 3 as "the ultimate update release to vSphere 7, making it the best vSphere ever." Yet the release was updated with version 3a less than a month after release, and Update 3b was necessary a couple of weeks later. Maybe Update 3 wasn't such a great release after all.
The other is that the deleted blog post about vSphere 3b stated that VMware "moved urgently to fix the top issues" which clearly didn't happen because one issue wasn't addressed.
The post also reveals that VMware is "looking at further increasing transparency for subsequent releases by publishing quality metrics that are accessible both internally and externally."
The Register imagines plenty of vSphere users will welcome transparency about how and why a significant update was bungled.
Read more here:
VMware pulls vSphere update that only made things worse - The Register
AWS adds Linux app streaming alongside Windows to ‘greatly lower’ cost – The Register
Amazon Web Services has added support for streaming Linux applications and desktops to its AppStream service, which was previously Windows-only, claiming that it will "greatly lower the total streaming cost."
AppStream 2.0 has been running since late 2016 and enables users to stream GUI applications or entire desktops to a local PC either via a web browser or using a Windows client. Although running applications remotely has some drawbacks such as latency, dependency on a strong internet connection, and potential snags accessing local resources like printers and storage it also has advantages.
Benefits include isolation from the local PC and some security risks, the ability to run Windows applications from any OS, and full control of the remote environment. In the case of demanding applications that perform intensive data processing or need high-end GPUs, renting a PC from AWS may work out cheaper than buying the hardware, if usage is only occasional.
GUI applications on Amazon Linux, now supported in the AppStream 2.0 service
Another use case is for software vendors wishing to offer a Windows desktop application as a service. The vendor handles the system requirements, application install, updates and data storage, so users can simply navigate to the application using a web browser.
The dominance of Windows in the desktop world is such that the demand for streaming is mainly for Windows applications. That has hitherto been the assumption in AppStream 2.0, but AWS has now introduced Linux application support.
"You can now stream Linux applications and desktops to your users, and greatly lower the total streaming cost by migrating Matlab, Eclipse, Firefox, PuTTY, and other similar applications from Windows to Linux on Amazon AppStream 2.0," the company said. Use cases offered are delivering software as a service (SaaS), remote Linux development environments, CAD applications that require high performance GPUs, and remote Linux learning environments.
How much will users save? A quick look at the pricing shows a potentially misleading example where Windows streaming costs $22.72 for a week versus $8.85 for Linux. The main reason is that Microsoft charges an RDS (Remote Desktop Services) fee for Windows streaming, in this case $4.19 per month or any part of a month, and making the calculation for a small number of hours for just one week makes this disproportionately large.
Pricing is based on instance costs and stream.standard.large (2 vCPU and 8GB RAM) costs $0.24 per hour for Windows, or $0.214 for Linux, for example, using current UK region prices. There is also a "stopped fee" of $0.029 per hour for either OS, and then the RDS fee on top in the case of Windows. This means the saving for using Linux will be relatively small in most scenarios. We may conclude that AWS is keen to make Linux look much cheaper than Windows, perhaps for strategic reasons.
There is more to this than cost savings. HP has been touting the advantages of running Linux applications on Windows because in the world of data science, Linux may be the better-supported environment. AWS has made sure to include GPU-oriented machine instances in its new AppStream 2.0 support. If the applications users require can be run on Linux, there may also be gains in efficiency and manageability as well as cost.
Linux images have appeared in the AppStream 2.0 image registry
How is AppStream 2.0 for Linux deployed? The starting point for any AppStream deployment is an OS image which admins can then customise, so the main change is that Linux images have now appeared in the list of AppStream 2.0 images available. These images are based on Amazon Linux 2.0, which is in the Red Hat family and perhaps most similar to Fedora.
Users may not be familiar with the idea of running GUI applications on Amazon Linux 2.0, which is popular for EC2 (Elastic Compute Cloud) virtual machines, but it can be done and there is documentation. We tried installing the recommended Mate desktop on an Amazon Linux 2.0 instance downloaded for on-premises use, which is also supported, and added the Chromium web browser to perhaps get a flavour of how this might look.
Most of the documentation for AppStream 2.0 remains Windows-only so it still feels bleeding-edge; we even noticed a bug in the Excel pricing tool which has been updated for Linux but breaks if one tries to choose Linux as the operating system.
The major difficulty is that as soon as users want to run, for example, the Microsoft Office desktop applications, or one of countless Windows-only business applications, Linux is no use to them. Nevertheless, the combination of WSL (Windows Subsystem for Linux), which now supports GUI applications, and AWS AppStream 2.0 adding Linux support, means that the obstacles to running Linux desktop applications in mainstream business environments are falling away.
More:
AWS adds Linux app streaming alongside Windows to 'greatly lower' cost - The Register